Email DMARC Report Analysis

Definition

DMARC (Domain-based Message Authentication, Reporting, and Conformance) aggregate report analysis is the process of parsing and interpreting the XML reports sent by receiving mail servers to the domain owner. These reports, known as RUA (Reporting URI for Aggregate) reports, contain detailed data about every email message claiming to be from the domain. Each report includes the sending IP address, the authentication results for SPF and DKIM, whether those results aligned with the domain in the From header, and the disposition applied by the receiver (none, quarantine, or reject). The analysis of these reports is essential for maintaining domain security, identifying legitimate and unauthorised sending sources, and progressing through DMARC enforcement levels.

The XML reports are generated daily by major receivers including Google, Microsoft, Yahoo, and Apple. Each report covers a single receiving domain over a 24-hour period and can contain thousands of individual record entries. The raw XML is not human-readable at scale — a domain sending 100,000 emails per day may receive dozens of reports with tens of thousands of entries. Analysis tools parse the XML, aggregate the data, and present it in dashboards showing authentication pass rates, source IP identification, geographic distribution of sending sources, and alignment failures. The analysis reveals which third-party services are sending as the domain (marketing platforms, CRM systems, transaction email providers), which sources are failing authentication (possibly indicating spoofing or misconfiguration), and which IP addresses are sending unauthorised messages that may represent phishing or impersonation attacks.

Best Practices

• Process DMARC aggregate reports daily using an automated analysis platform. Manual XML parsing is impractical beyond very low volume. Tools including dmarcian, Valimail, Proofpoint, and Agari provide automated report aggregation, visualisation, and alerting. Configure analysis to categorise sources as authorised, unauthorised, or unknown based on your approved sender inventory.

• Build and maintain a comprehensive authorised sender inventory alongside DMARC report analysis. Document every service, platform, or server authorised to send email from your domain including IP addresses, sending patterns, and authentication configuration. Cross-reference report data against this inventory daily. Flag unauthorised sources for investigation within 24 hours.

• Analyse SPF and DKIM alignment separately in each report entry. SPF alignment requires the domain in the Envelope From (Return-Path) to match the domain in the From header. DKIM alignment requires the signing domain (d= parameter) to match the From domain. Track alignment pass rates per source to identify authentication configuration issues.

• Progress through DMARC enforcement levels based on analysis findings. Start with p=none (monitoring only) for a minimum of 30 days to baseline sending. Advance to p=quarantine when 95% of legitimate traffic passes authentication. Advance to p=reject when unauthorised traffic is identified and remediated. Maintain p=none for at least three months before considering enforcement.

• Establish remediation workflows for findings from DMARC report analysis. When reports reveal unauthorised sending sources, investigate and determine if they are legitimate but misconfigured senders (fix authentication) or malicious (report to hosting provider, update DNS, consider legal action). When legitimate senders fail authentication, work with them to implement SPF and DKIM correctly.