Definition
The rua= and ruf= tags are the two reporting fields in a DMARC record. The rua= tag (Reporting URI for Aggregate data) tells receiving servers where to send daily XML summaries of authentication results, while the ruf= tag (Reporting URI for Forensic data) specifies where to send detailed, message-level reports about individual failures. Together they turn DMARC from a passive policy into an active monitoring system.
How It Works
Both tags point to a destination, most commonly a mailto: address such as rua=mailto:dmarc@example.com. When a receiving server processes mail claiming to be from the domain, it uses these tags to decide where reports are delivered.
| Tag | Report type | Frequency | Content |
|---|---|---|---|
rua= |
Aggregate | Daily | XML summary of all traffic, IPs, and pass/fail results |
ruf= |
Forensic | Near real time | Full headers and sometimes body of individual failures |
The rua= tag is mandatory in most DMARC records because aggregate reports are the foundation of monitoring. The ruf= tag is optional and less widely supported, largely because message-level data raises privacy considerations.
Best Practices
- Use a dedicated, monitored mailbox for reports rather than an unattended address. Reports that are never read provide no value.
- Route reports to a parsing tool. Raw XML aggregate reports are difficult to read by hand; tools can ingest them directly and surface anomalies.
- Consider third-party processors. Some providers offer a report-analysis endpoint that accepts reports on your behalf and displays them in a dashboard.
- Keep the
ruf=address separate from everyday inboxes, as forensic reports can be noisy and occasionally contain sensitive content. - Validate your record after publishing to confirm the tags are syntactically correct and that reports are actually arriving.
A common mistake is publishing a rua= address and then never checking it. Monitoring is only useful if the data is reviewed, ideally with alerting tied to unexpected sending sources that could indicate email spoofing.
Example
A company publishes v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com; ruf=mailto:dmarc-forensics@example.com. Daily aggregate reports arrive at the first address and are auto-forwarded to a monitoring tool. A week later, a forensic report lands in the second inbox showing a spoofed message using the company's domain, allowing the security team to act within hours.
Was this useful?
Related Glossary Terms
Abuse Complaint
An abuse complaint is a report from a recipient who marks an email as spam, which negatively affects sender reputation and deliverability.
Alt Text
Alt text is the written alternative to an image in an email, displayed when images are blocked, slow to load, or consumed by screen readers.
AOL Mail for Email Marketers
AOL Mail is a legacy email provider with specific deliverability requirements and rendering quirks, now operating as part of the Yahoo+AOL network under shared infrastructure.
Apple App Password (Email)
An Apple app password is a generated, app-specific password used to sign into an email account through clients that do not support two-factor authentication.
Email Authentication Protocols
Email authentication protocols are technical standards that verify the identity of an email sender, helping mailbox providers distinguish legitimate mail from spam and phishing.
BIMI
BIMI (Brand Indicators for Message Identification) is an email standard that allows brands to display their logo next to their emails in supported email clients. It requires DMARC enforcement at quarantine or reject policy.
Frequently Asked Questions
The `rua=` tag is required for a DMARC record to request aggregate reports and is considered essential. The `ruf=` tag is optional; some providers will not send forensic reports unless both tags are present.
Yes. Both tags accept a comma-separated list of URIs, so reports can be delivered to multiple destinations, such as an internal address and a third-party analysis service.
Aggregate reports are daily XML summaries covering all traffic and every sending IP. Forensic reports describe a single failing message in detail, including headers and sometimes body content, and arrive in near real time.
No. Reports are purely informational feedback sent by receiving servers. They do not affect whether your messages reach the inbox, though the authentication results they reveal can guide fixes that improve deliverability.