The short answer

DMARC aggregate reports list every server that sent email using your domain, how many messages it sent, and whether they passed SPF and DKIM. You read them to find your genuine senders and fix any that fail.

Once every genuine sender passes, you can safely tighten your policy from none to quarantine and then reject.

The two kinds of report

  • Aggregate reports are sent to the address in your record’s rua= tag. They are XML files, usually zipped, and most providers send one a day. You get a separate report from each receiving provider.
  • Forensic reports go to the ruf= address. They are meant to describe single failed messages, but most large providers do not send them for privacy reasons. Do not rely on them.

Reading raw XML is slow. Many people use a DMARC reporting service that collects the files and shows them as charts. The fields below are the same either way.

What a record looks like

Each report contains one or more records. Here is a simplified example for a fictional domain:

<record>
  <row>
    <source_ip>203.0.113.10</source_ip>
    <count>42</count>
    <policy_evaluated>
      <disposition>none</disposition>
      <dkim>pass</dkim>
      <spf>fail</spf>
    </policy_evaluated>
  </row>
  <identifiers>
    <header_from>example.com</header_from>
  </identifiers>
  <auth_results>
    <dkim><domain>example.com</domain><result>pass</result></dkim>
    <spf><domain>mailer.example.net</domain><result>pass</result></spf>
  </auth_results>
</record>

This says one server sent 42 messages as example.com. DKIM passed and aligned. SPF passed for a different domain, so it did not align. Because DKIM aligned, the messages passed DMARC.

The fields that matter

  • source_ip: the server that sent the mail. Look it up to see which company owns it.
  • count: how many messages came from that server in the report period.
  • disposition: what the receiver did, under your policy: none, quarantine or reject.
  • dkim and spf under policy_evaluated: whether each check passed and aligned with your domain. This is what DMARC uses.
  • header_from: the domain in the “from” address people saw.
  • auth_results: the raw SPF and DKIM results, including which domain was checked.

A message passes DMARC if either DKIM or SPF passes and aligns. It does not need both.

Sorting what you find

  1. Your known senders that pass. Your main email service, such as Microsoft 365 or Google Workspace. Nothing to do.
  2. Your known senders that fail. Often a website form, invoicing tool or newsletter service. Add its SPF include or DKIM records so it aligns.
  3. Forwarding and mailing lists. When mail is forwarded, SPF often fails, and lists can break DKIM. These show up as failures from servers you do not recognise but with low counts. They are usually not a problem you can fix.
  4. Unknown senders that fail. Servers you have never used sending as your domain. This is often spoofing, which a stricter DMARC policy will block.

Patterns you will often see

  • Large counts from Microsoft or Google servers that pass. Your normal staff email. This is what good looks like.
  • A steady trickle from a marketing or CRM service with SPF aligned but DKIM failing. The tool is sending with its own DKIM domain. Add the DKIM records it gives you.
  • A burst on one day from a server you do not know. Often a spoofing run. Check whether the messages failed both checks.
  • Small counts from many unfamiliar servers that fail SPF but pass DKIM. Usually forwarding. DKIM is doing its job.

A routine for your first month

  • Week 1. Publish DMARC with p=none. Make a list of every tool you think sends email for you.
  • Week 2. Compare the reports with your list. Note each sender that fails.
  • Week 3. Fix the failing senders you own. Set up DKIM for each tool where you can.
  • Week 4. Check the fixes show as passing. Look for any sender you missed, such as a monthly billing run.

Moving to quarantine and reject

When your genuine senders all pass, move to p=quarantine. Failing mail then goes to junk. Many receivers also honour the pct= tag, which applies the policy to only part of the failing mail, such as pct=25. You can raise it step by step to 100.

Newer versions of the DMARC standard change how partial rollouts work, so treat pct as a helpful step, not a guarantee. After a few weeks at full quarantine with no surprises, move to p=reject. Keep reading reports afterwards, especially when you add a new tool.

Getting help

If the reports show senders you cannot identify, or genuine mail failing, we can go through them with you. See DMARC setup, fixing emails that go to spam, what DMARC is and why business emails go to spam. Start with our free email check.