Understanding Failure Reports (RUF)
What Are Failure Reports?
Failure reports (also called forensic reports) are sent in real-time when an individual email fails DMARC authentication. They provide detailed information about the specific failing message.
RUF vs RUA
| Feature | RUA (Aggregate) | RUF (Forensic) |
|---|---|---|
| Frequency | Daily summary | Real-time per failure |
| Detail level | Aggregated by IP | Individual messages |
| Content | Counts & results | Headers & metadata |
| Privacy | Low risk | May contain PII |
| Availability | All major providers | Limited providers |
Enabling RUF
Add the ruf tag to your DMARC record:
v=DMARC1; p=reject; rua=mailto:rua@reports.dmarc.ws; ruf=mailto:ruf@reports.dmarc.ws; fo=1
The fo=1 tag means generate a report if any mechanism fails (vs the default fo=0 which requires all to fail).
Availability
Many major email providers (including Google) do not send RUF reports due to privacy concerns. Microsoft and some others do send them. DMARC.WS will display any RUF reports that are received.
Enhanced+ Feature
Failure report viewing is available on Enhanced and Enterprise plans.