Monitoring and Understanding DMARC Reports

What Are DMARC Reports?

When you publish a DMARC record with reporting addresses (rua and ruf tags), receiving mail servers send you data about emails claiming to be from your domain. These reports help you understand who is sending email on your behalf and whether authentication is working correctly.

What Aggregate Reports Contain

Aggregate reports are XML files that summarize authentication results for emails sent from your domain over a reporting period (usually 24 hours). Each report includes:

Reading XML Report Data

DMARC aggregate reports arrive as XML files, often compressed (.gz or .zip). Here is a simplified example showing the key elements:

<?xml version="1.0" encoding="UTF-8"?>
<feedback>
  <report_metadata>
    <org_name>google.com</org_name>
    <email>noreply-dmarc-support@google.com</email>
    <report_id>12345678901234567890</report_id>
    <date_range>
      <begin>1704067200</begin>
      <end>1704153599</end>
    </date_range>
  </report_metadata>

  <policy_published>
    <domain>example.com</domain>
    <p>quarantine</p>
    <sp>quarantine</sp>
    <pct>100</pct>
  </policy_published>

  <record>
    <row>
      <source_ip>192.0.2.1</source_ip>
      <count>150</count>
      <policy_evaluated>
        <disposition>none</disposition>
        <dkim>pass</dkim>
        <spf>pass</spf>
      </policy_evaluated>
    </row>
    <identifiers>
      <header_from>example.com</header_from>
    </identifiers>
    <auth_results>
      <dkim>
        <domain>example.com</domain>
        <result>pass</result>
      </dkim>
      <spf>
        <domain>example.com</domain>
        <result>pass</result>
      </spf>
    </auth_results>
  </record>
</feedback>

Common Issues Revealed in Reports

Failed SPF/DKIM Alignment

SPF or DKIM may pass, but if the domain does not align with the From header, DMARC will fail. This often happens when:

• Third-party services send on your behalf without proper DKIM signing
• Email forwarding breaks SPF alignment
• Marketing platforms use their own domain in the envelope sender
• Subdomains are used without corresponding authentication records

Unknown or Unauthorized Senders

Reports may show IPs you do not recognize sending mail as your domain. These could be:

• Spoofing attempts or phishing campaigns using your domain
• Legitimate services you forgot about (old marketing tools, CRM systems)
• Shadow IT - employees using unauthorized email services
• Compromised servers sending spam

Inconsistent Authentication

Some messages pass while others fail from the same source:

• DKIM key rotation issues causing intermittent failures
• Load balancers or CDNs not in your SPF record
• DNS propagation delays after record changes
• Misconfigured email servers with inconsistent signing

Third-Party DMARC Report Analyzers

Manually parsing XML reports is tedious and error-prone. DMARC report analyzers aggregate your reports, visualize trends, and alert you to issues. Popular options include:

To use these services, update your DMARC record's rua tag to point to the analyzer's reporting address alongside or instead of your own.

Acting on Report Data

DMARC reports are only valuable if you act on them. Follow this process to improve your email authentication:

Step 1: Identify All Legitimate Senders

Review source IPs in your reports and identify which ones belong to services you use. Use reverse DNS lookups and IP geolocation to help identify unknown senders.

# Reverse DNS lookup
dig -x 192.0.2.1

# Or use nslookup
nslookup 192.0.2.1

Step 2: Update SPF Records

Add missing authorized senders to your SPF record. Be mindful of the 10 DNS lookup limit.

Step 3: Configure DKIM for Third Parties

Work with your email service providers to enable DKIM signing with your domain. Most major ESPs support custom DKIM.

Step 4: Gradually Tighten Your Policy

Once legitimate senders pass consistently, move from p=none to p=quarantine, then eventually to p=reject:

# Start with monitoring
v=DMARC1; p=none; rua=mailto:dmarc@example.com

# Move to quarantine (after 2-4 weeks of clean reports)
v=DMARC1; p=quarantine; pct=25; rua=mailto:dmarc@example.com

# Increase percentage gradually
v=DMARC1; p=quarantine; pct=100; rua=mailto:dmarc@example.com

# Finally, enforce reject
v=DMARC1; p=reject; rua=mailto:dmarc@example.com

Forensic Reports vs Aggregate Reports

DMARC defines two types of reports, each serving different purposes:

To receive forensic reports, add the ruf tag to your DMARC record:

v=DMARC1; p=quarantine; rua=mailto:dmarc-agg@example.com; ruf=mailto:dmarc-forensic@example.com; fo=1

The fo tag controls when forensic reports are generated:

• fo=0 - Generate if all mechanisms fail (default)
• fo=1 - Generate if any mechanism fails
• fo=d - Generate if DKIM fails
• fo=s - Generate if SPF fails

Summary

Resources