In short
A DMARC report analyser collects your aggregate XML reports, names the service behind each IP address and shows pass rates and failures by sender. For UK buyers, data location is a common question: EasyDMARC processes reports in Ireland when you use its .eu reporting addresses, and Valimail Monitor offers free visibility with a weekly report.
Get a quote for DMARC report analysis
Tell us roughly how many users or sites you have and we will come back to you with options and a quote.
What a DMARC analyser does
A DMARC analyser (or DMARC reporting tool, report reader or parser) does the work that makes DMARC reports usable:
- Collects the reports at a reporting address it hosts, so they stay out of staff mailboxes
- Parses the XML from every receiver and combines it into one view per domain
- Names the senders: it turns IP addresses into services such as Microsoft 365, Google Workspace or your CRM
- Shows pass rates and failure reasons for each source, so you can see which senders need SPF or DKIM (opens in a new tab) work
- Trends the results over days and months, so you know when a domain is ready for a stricter policy
- Alerts you to changes, such as a new failing source, reports stopping or a DNS record changing
The difference is easiest to see in the sender list. Valimail puts it this way: raw reports arrive as XML listing IP addresses (opens in a new tab), whereas a platform shows not "104.47.51.33" but "Microsoft 365". Once every row has a name, separating your own mail from spoofing is far quicker.
What to look for in a DMARC reporting tool
These are the questions worth asking of any analyser:
| Feature | Why it matters | Question to ask |
|---|---|---|
| Sender identification | Named services are far quicker to work through than IP addresses | How does it identify and group sending sources? |
| Failure reasons per source | Tells you whether a sender needs DKIM, SPF or alignment work | Does it show why each source fails, with a fix? |
| Alerts | Problems are spotted when they start, not at the next review | Can it alert on new failing sources, record changes and reports stopping? |
| Hosted reporting address | Reports go straight to the platform; large volumes are handled | Does it host the rua address and publish the authorisation record? |
| Failure (ruf) report handling | Useful for diagnosis, but may contain personal data | Does it show failure detail, and how is it stored? |
| Multi-domain and multi-tenant | Most organisations own more domains than they think | How are many domains, subdomains and teams handled? |
| Data location and retention | Matters for UK GDPR and public sector buyers | Where are reports processed, and how long is history kept? |
| Policy management | Moving to enforcement means changing records, safely | Can it manage the DMARC, SPF and DKIM records too? |
| Export and API | For audit evidence, SIEM tools and your own reporting | Can data be exported or pulled through an API? |
Not sure which option fits? Ask us
Tell us what you need and we will recommend the right option for your organisation, with a quote.
How EasyDMARC, Valimail and Check Point handle reporting
We supply all three. Each describes its reporting differently, so here is what each says on its own website and documentation:
| Capability | EasyDMARC | Valimail | Check Point DMARC Management (opens in a new tab) |
|---|---|---|---|
| How reports are collected | Reporting addresses hosted by EasyDMARC, with regional options (data hosting (opens in a new tab)) | You add Valimail's reporting address to your rua tag (support (opens in a new tab)) | A dedicated hosted RUA mailbox (opens in a new tab) per tenant, or a protected internal mailbox |
| Sender view | Aggregate reports turned into dashboards, grouped by sending source with vendor-level visibility and geolocation (reporting (opens in a new tab)) | Services identified by name; Enforce's account overview (opens in a new tab) shows top senders, a world map and failure rates over 7 to 90 days | Per-domain DMARC % Success, reported and failed emails (status (opens in a new tab)), and a Top Sending Domains widget (opens in a new tab) |
| Failure reports | Full RUF detail: From address, subject, date and header | Aggregate (rua) reporting; Valimail says it sees no personal data (opens in a new tab) | Generates virtual RUF reports (opens in a new tab) for failing mail seen in its own network |
| Guidance and alerts | Alerts on DNS record changes, blocklist listing and email volume changes, on plans that include alerting | Team-based alerting in Core; advanced alerting and policy change detection in Pro (MSP editions (opens in a new tab)) | Recommendations per domain, and alerts (opens in a new tab) on record errors, drops in success rate, reports stopping and new failing sources |
| Free option | Free XML report analyser (opens in a new tab) for uploaded files, and a 14-day trial | Valimail Monitor (opens in a new tab) is free, with a weekly report (opens in a new tab) | A 14-day free trial of Check Point Email Security |
| Often a good fit for | Teams wanting hands-on dashboards and managed records across many domains | Teams wanting named-sender visibility and automated enforcement | Organisations using or choosing Check Point Email Security |
The last row is a guide to fit, not a ranking: the right choice depends on your domains, your senders and how hands-on your team wants to be. See EasyDMARC vs Valimail and DMARC management for more detail, and ask us for a quote on any of them.
Free DMARC analysers or a managed platform?
Free tools are a good way to start, and the vendors we supply offer several:
- EasyDMARC's DMARC Report Analyzer (opens in a new tab) lets you upload an XML report and sorts its sources into compliant, non-compliant, threat or unknown, and forwarded
- Valimail Monitor is free, with no credit card required, identifies the services sending as your domain and sends a weekly DMARC report (opens in a new tab) showing which domains pass and fail
- Trials let you run a full platform on your real reports: EasyDMARC offers a 14-day free trial, and Check Point offers a 14-day trial of Email Security
A managed platform adds the parts that matter once you start changing policy: continuous collection at a hosted address, alerts when something changes, history to show progress to auditors or insurers, and tools to manage the records themselves, such as EasyDMARC Managed DMARC (opens in a new tab), Valimail's automated record management or Check Point's SPF and DKIM Management. For a single domain at p=none, a free tool may be all you need for now; for several domains moving to enforcement, a platform saves a great deal of time.
Is DMARC report analysis the right fit for you?
We will check it against your systems and requirements and recommend the right option.
Getting your reports flowing to an analyser
Connecting an analyser is a small DNS change, and it does not touch your mail flow:
- Get the reporting address from the platform (in Check Point's case, from DMARC > Overview > Configuration in the portal)
- Add it to the rua tag of each domain's DMARC record, alongside any address you want to keep, or create a p=none record if there is none yet
- Check that the platform has published the external authorisation record, so receivers agree to send reports to it
- Wait for the first reports: aggregate reports are sent at least daily by most receivers, so the first usually arrive the next day
- If you are moving from another tool, consider importing your historical reports so your trends start from day one
EasyDMARC's migration guide (opens in a new tab) describes updating the reporting destination as the only DNS-level change required, with mail flow unchanged and an optional import of historical reports. Valimail says pointing your rua tag at Monitor causes no change to your email flow (opens in a new tab). See how to set up DMARC if your domains do not have records yet.
How we help you choose an analyser
Because we supply more than one platform, we can recommend the analyser that fits your domains and your team. We can:
- Assess your domains: count the domains and subdomains you own and see which already send reports, and where
- Set up reporting: point each domain's rua tag at the platform and confirm the reports arrive
- Choose and supply the platform: compare EasyDMARC, Valimail and the Check Point Email Security DMARC Management add-on against your senders, data location needs and team
- Move you to enforcement: use the analyser's findings to fix each sender and plan each policy step
Licences can be billed monthly, with terms confirmed at quote. Contact us for free advice on which DMARC analyser suits you.
Frequently asked questions
Is there a free DMARC report analyser?
Yes. EasyDMARC's DMARC Report Analyzer (opens in a new tab) analyses XML reports you upload, and Valimail Monitor (opens in a new tab) is a free platform that identifies the services sending as your domain and emails you a weekly report (opens in a new tab). Full platforms with alerts, history and record management are paid, and offer trials; ask us for a quote.
What is a DMARC parser?
A DMARC parser reads the XML in aggregate reports and turns it into rows of data: sending IP, message count, SPF and DKIM results and the receiver's disposition. Every DMARC analyser includes one. The analyser then adds the useful parts on top, such as naming each sending service, combining reports from every receiver, and showing trends and alerts.
Can I import old DMARC reports?
Often, yes. EasyDMARC's migration process (opens in a new tab) includes an optional import of historical reports, so your history carries over when you move from another tool. EasyDMARC's free analyser also accepts uploaded XML files. Whether a particular platform and plan supports import is confirmed at quote.
Where is DMARC report data stored?
It depends on the platform and, sometimes, the reporting address you use. EasyDMARC processes reports sent to its .eu addresses in Ireland, and other addresses in other regions (data hosting locations (opens in a new tab)). Check Point's guide says reports are stored for 60 days. Aggregate reports contain no personal data under RFC 9990; failure reports may, so check how they are stored.
Does changing my DMARC analyser affect my email?
No. Changing analyser means changing the rua address in your DMARC record, which only changes where receivers send their reports. Your policy, SPF and DKIM stay as they are, so delivery is unaffected. You can keep both addresses in the rua tag for a while if you want to compare.
Still have a question about DMARC report analysis?
Ask us and a member of our team will get back to you.
More DMARC guides
EasyDMARCEasyDMARC: DMARC monitoring, Managed DMARC and EasySPF explained.
ValimailValimail: automated DMARC monitoring and enforcement with Instant SPF.
Check Point DMARCThe DMARC Management add-on for Check Point Email Security.EasyDMARC vs ValimailEasyDMARC and Valimail compared side by side.