Definition
A DMARC forensic report is a detailed, message-level report that a receiving server sends when an individual email fails DMARC evaluation. Unlike aggregate reports, which summarise traffic in bulk, a forensic report includes the full message headers and often the message body, allowing the domain owner to inspect the exact email that failed. Forensic reports are delivered to the address defined in the DMARC record's ruf= tag.
How It Works
When a message fails DMARC alignment or policy, the receiving server may generate a forensic report and transmit it to the ruf= address. The report is typically an email that wraps a text or XML representation of the original message, including the Subject, From, Return-Path, and authentication results.
The structure of a forensic report includes:
- The original message headers so the owner can identify the sending source.
- The SPF and DKIM results and the reason for the DMARC failure.
- A timestamp and the reporting organisation.
- Optionally, a copy of the message body or a truncated portion of it.
Forensic reports are transmitted in near real time, in contrast to aggregate reports that arrive daily. This immediacy makes them valuable for catching a spoofing campaign as it unfolds rather than a day later.
Common Limitations
Forensic reports are less universally supported than aggregate reports. Several factors limit their usefulness:
- Many mailbox providers disable forensic reporting by default because forwarding message content raises privacy and data-handling concerns.
- Reports may be redacted or omit the body when the content could expose personal data.
- The volume of forensic reports can be noisy, especially for large domains with many legitimate but misconfigured senders.
Because of these limitations, most organisations rely primarily on DMARC aggregate reports for routine monitoring and use forensic reports selectively when investigating a specific incident.
Example
A bank publishes ruf=mailto:abuse@bank.com. One morning a forensic report arrives showing an email that used the bank's domain in the From: header but was sent from an unknown server. The bank's team reads the headers, identifies the IP and its hosting provider, and files an abuse report while confirming the message failed DKIM alignment. The forensic report gave them the evidence needed to act within minutes.
Was this useful?
Related Glossary Terms
Abuse Complaint
An abuse complaint is a report from a recipient who marks an email as spam, which negatively affects sender reputation and deliverability.
Alt Text
Alt text is the written alternative to an image in an email, displayed when images are blocked, slow to load, or consumed by screen readers.
AOL Mail for Email Marketers
AOL Mail is a legacy email provider with specific deliverability requirements and rendering quirks, now operating as part of the Yahoo+AOL network under shared infrastructure.
Apple App Password (Email)
An Apple app password is a generated, app-specific password used to sign into an email account through clients that do not support two-factor authentication.
Email Authentication Protocols
Email authentication protocols are technical standards that verify the identity of an email sender, helping mailbox providers distinguish legitimate mail from spam and phishing.
BIMI
BIMI (Brand Indicators for Message Identification) is an email standard that allows brands to display their logo next to their emails in supported email clients. It requires DMARC enforcement at quarantine or reject policy.
Frequently Asked Questions
No. Many providers redact or omit the body to protect the privacy of the recipients and any personal data the message contained. The full headers are usually included, which is generally enough to diagnose the failure.
The `ruf=` tag tells receiving servers where to send forensic reports. If it is absent, providers will not send message-level failure details. Some providers require both `rua=` and `ruf=` to be present before they will honour either report type.
Aggregate reports arrive daily as XML summaries of all traffic, while forensic reports arrive in near real time and describe a single failed message with its headers and sometimes body. Aggregate reports show the big picture; forensic reports provide the evidence for a specific event.
Yes. Because they include the actual headers of spoofed messages, forensic reports let a domain owner quickly confirm email spoofing attempts and pass actionable evidence to hosting providers or law enforcement.