DMARC guide
What DMARC aggregate reports are, how to switch them on with rua, and how to read one to find who is sending as you.
When your DMARC record has a rua= tag, Gmail, Yahoo, Microsoft and other inboxes send you a daily report listing every server that sent email using your domain, and whether each one passed SPF and DKIM. They arrive as zipped XML files, one per provider per day.
Add a report address to your record. The DMARC record generator does it for you:
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com
Sending reports to a different domain, such as a reporting service? That domain must publish a TXT record allowing it, at yourdomain.com._report._dmarc.theirdomain.com with the value v=DMARC1. Good services do this for you.
| Part of the report | What it tells you |
|---|---|
org_name | Who sent the report, such as google.com or Microsoft |
date_range | The period covered, usually one day |
policy_published | Your DMARC record as they saw it |
source_ip | A server that sent email using your domain |
count | How many emails came from that server |
disposition | What they did: none, quarantine or reject |
dkim / spf | Whether each passed and lined up with your domain |
header_from | The domain in the From address |
Group the rows by server. Each source_ip is a sender. Work out who each belongs to: your inbox provider, newsletter tool, CRM, or someone you don’t know.
Check your own senders pass. Every service you use should show dkim: pass or spf: pass lined up with your domain. Any that fail need fixing before you tighten the policy.
Look at the strangers. Servers you don’t recognise that fail both are usually someone faking your domain. Those are exactly what p=quarantine and p=reject stop.
Tighten when it’s clean. After two to four weeks with only your own senders passing, follow how to enable your DMARC policy.
The ruf= tag asks for a copy of each failing email. Most big inboxes no longer send them for privacy reasons, so aggregate reports are what you’ll actually use.
Check your report address
Look up your DMARC record to confirm the rua address is set and correct.
Sponsored
EasyDMARC
Reading DMARC reports by hand is painful. EasyDMARC turns them into a dashboard and shows exactly which senders fail.
