DMARC aggregate report reader
DMARC reports arrive as gzipped XML that is unreadable by hand, which is why most
people publish rua and then never look. Drop the .gz in as it arrived,
or paste the XML.
What to look for
The section that matters is sources failing DMARC. Every IP there is either someone spoofing your domain, or — far more often — a legitimate service you forgot you were using. Invoicing tools, recruiting platforms and support desks are the usual suspects.
Authenticate every legitimate source you find before tightening your policy. Moving to
p=reject with an unauthenticated sender still in the list will silently destroy that
sender's mail, and you will not get a bounce telling you so. The
rollout guide covers the staging.
Why the alignment columns can disagree with the raw result
A report can show SPF passing while DMARC still fails the message. The
policy_evaluated values are what DMARC concluded after applying alignment;
the auth_results domains show what each mechanism actually authenticated. When those
two disagree, alignment is your answer — see aspf and
adkim.
No reports arriving?
You need a rua tag in your DMARC record. Without it receivers have nowhere to send anything, which is the single most common reason a DMARC deployment produces no visibility at all.