Definition
DMARC (Domain-based Message Authentication, Reporting, and Conformance) generates two types of reports when you configure a reporting address in your DMARC record. These reports are how you learn what the wider internet believes about your domain's email — who is sending as you, whether it authenticates, and what receiving ISPs are doing with it.
Aggregate reports (RUA) arrive as XML summaries, typically hourly or daily, showing how many messages passed or failed SPF and DKIM, broken down by source IP and disposition (pass, quarantine, reject). Forensic reports (RUF) contain details about individual failed messages, including headers and sometimes content.
What DMARC Reporting Tells You
- All legitimate sending sources — including ones you forgot about (CRMs, marketing platforms, transactional providers)
- Spoofing and phishing attempts — unauthenticated messages claiming to be you
- SPF and DKIM alignment failures — where your setup is incomplete
- Disposition actions — what ISPs are doing with failing messages
How to Read an Aggregate Report
| Field | What It Means |
|---|---|
| Source IP | Where the message originated |
| SPF / DKIM | Whether each check passed, failed, or was absent |
| Disposition | Pass, quarantine, reject, or none |
| Policy applied | The DMARC policy in effect (none, quarantine, reject) |
| Header From domain | The domain the recipient saw |
How to Use DMARC Reporting
- Publish a
p=nonepolicy with anrua=address and monitor for 2-4 weeks - Identify every legitimate sender from the source IPs in the reports
- Fix authentication failures — add SPF records and DKIM for each sending service
- Add senders to your SPF/DKIM configuration before they are blocked
- Progress to quarantine then reject only when all legitimate mail authenticates
- Keep monitoring — reports reveal new senders and new spoofing attempts
Was this useful?
Related Glossary Terms
Abuse Complaint
An abuse complaint is a report from a recipient who marks an email as spam, which negatively affects sender reputation and deliverability.
Alt Text
Alt text is the written alternative to an image in an email, displayed when images are blocked, slow to load, or consumed by screen readers.
AOL Mail for Email Marketers
AOL Mail is a legacy email provider with specific deliverability requirements and rendering quirks, now operating as part of the Yahoo+AOL network under shared infrastructure.
Apple App Password (Email)
An Apple app password is a generated, app-specific password used to sign into an email account through clients that do not support two-factor authentication.
Email Authentication Protocols
Email authentication protocols are technical standards that verify the identity of an email sender, helping mailbox providers distinguish legitimate mail from spam and phishing.
BIMI
BIMI (Brand Indicators for Message Identification) is an email standard that allows brands to display their logo next to their emails in supported email clients. It requires DMARC enforcement at quarantine or reject policy.
Frequently Asked Questions
RUA (aggregate) reports summarise authentication results across all messages from a domain — volume, sources and dispositions. RUF (forensic) reports contain details of individual failed messages. Aggregate reports are essential for configuration; forensic reports are optional and raise privacy concerns because they may contain message content.
You receive them at the address you set in the `rua=` (and `ruf=`) tag of your DMARC TXT record. Most organisations use a DMARC analytics service that parses the XML into a readable dashboard rather than handling raw XML files.
Either you have a third-party service sending as your domain (a CRM, marketing or transactional provider) or the reports are capturing spoofing attempts. Cross-check each source IP against your known senders; anything unexplained is a security signal worth investigating.
Most guidance recommends 2-4 weeks of `p=none` monitoring, but large or fragmented sending infrastructure can take longer. Enforce quarantine and then reject only when every legitimate sender authenticates, or you risk blocking your own email.
No. Reporting (monitoring) tells you what is happening; enforcement (quarantine/reject policies) tells receiving ISPs what to do with failing mail. You start with reporting and move to enforcement only once you understand and fix your authentication landscape.