Understanding Aggregate Reports (RUA) — Docs

What Are Aggregate Reports?

Aggregate reports are XML files sent daily by email receivers (Google, Microsoft, Yahoo, etc.) that summarize authentication results for your domain.

What's in a Report?

Each report contains:

Reporter — Which organization sent the report
Date range — Usually 24 hours
Your published policy — What DMARC policy was in effect
Records — One per unique sending IP, showing:
- Source IP address
- Message count
- SPF result (pass/fail)
- DKIM result (pass/fail)
- Policy applied (none/quarantine/reject)

Key Metrics

Pass Rate

The percentage of messages where SPF or DKIM (or both) passed and aligned with your From domain. Target: 95%+ before enforcing.

Top Sources

The IP addresses sending the most email as your domain. Use reverse DNS to identify the service (e.g., Google, SendGrid).

DMARC.WS automatically identifies vendors by hostname, so you don't need to do manual lookups.

Report Delivery

Reports arrive at the email address specified in your rua tag. DMARC.WS provides a dedicated address that automatically parses and visualizes your reports.

Most providers send reports daily, though timing varies. Expect your first report within 24-48 hours of publishing your DMARC record.