Skip to content
Back to Blog
DMARC.WS Team··9 min read

Understanding DMARC Reports: A Practical Guide

DMARCReportsAnalysis

Types of DMARC Reports

DMARC generates two types of reports:

1. Aggregate Reports (RUA)

  • Sent daily by email providers
  • XML format (usually gzipped)
  • Contain summarized data about all emails from your domain
  • Specified via the rua tag

2. Forensic Reports (RUF)

  • Sent in real-time when authentication fails
  • Contain details about individual failing messages
  • Specified via the ruf tag
  • Many providers don't send these due to privacy concerns

Anatomy of an Aggregate Report

Aggregate reports are XML files with this structure:

Report Metadata

<report_metadata>
  <org_name>google.com</org_name>
  <date_range>
    <begin>1708905600</begin>
    <end>1708992000</end>
  </date_range>
</report_metadata>

This tells you who sent the report (Google) and the time period it covers (usually 24 hours).

Published Policy

<policy_published>
  <domain>example.com</domain>
  <p>reject</p>
  <pct>100</pct>
</policy_published>

This reflects the DMARC policy the reporter found for your domain.

Individual Records

<record>
  <row>
    <source_ip>209.85.220.41</source_ip>
    <count>1523</count>
    <policy_evaluated>
      <disposition>none</disposition>
      <dkim>pass</dkim>
      <spf>pass</spf>
    </policy_evaluated>
  </row>
</record>

Each record represents a group of emails from a specific IP address.

Key Metrics to Monitor

Pass Rate

The percentage of emails that pass both SPF and DKIM alignment. Target: 95%+ before moving to enforcement.

Top Sending Sources

Identify all IP addresses sending email as your domain. Cross-reference with your known email services to spot unauthorized senders.

Disposition Breakdown

  • none — Email was delivered (no enforcement)
  • quarantine — Email was sent to spam
  • reject — Email was blocked

SPF vs DKIM Results

Track which authentication method is failing. Common patterns:

  • SPF fails, DKIM passes — Usually forwarded email (normal)
  • SPF passes, DKIM fails — DKIM may not be configured for that sender
  • Both fail — Likely spoofing or misconfigured sender

What to Look For

Legitimate senders failing authentication

If you see Google IPs (209.85.x.x) or Microsoft IPs (40.107.x.x) failing, your SPF or DKIM is misconfigured for those services.

Unknown high-volume senders

Large volumes from unrecognized IPs could indicate spoofing. Investigate with a reverse DNS lookup.

Geographic anomalies

If you only operate in the US but see high volumes from unexpected countries, it may indicate abuse.

Making Reports Actionable

Raw XML reports are hard to read. Tools like DMARC.WS automatically:

  1. Parse the XML into readable dashboards
  2. Identify sending sources by vendor (Google, Microsoft, SendGrid, etc.)
  3. Track your pass rate over time
  4. Alert you when authentication rates drop
  5. Visualize sending patterns on geographic maps

Report Frequency

Provider Frequency Notes
Google Daily Very reliable
Microsoft Daily Sometimes delayed
Yahoo Daily Reliable
Apple Daily Newer, improving
Others Varies Some send weekly

Best Practices

  1. Set up RUA from day one — There's no downside to receiving reports
  2. Use a dedicated reporting service — Don't send reports to your personal inbox
  3. Review weekly — Check for new senders and authentication failures
  4. Act on failures — Fix SPF/DKIM issues before they affect deliverability
  5. Keep historical data — Trends over time are more valuable than snapshots