Guides · Updated 2026-10-11

DMARC aggregate reports explained

Receivers that support DMARC send aggregate (rua) reports, usually daily XML files (often zipped), to the addresses in your rua= tag. Each report lists, per source IP, how many messages it saw, and whether SPF, DKIM and DMARC passed and aligned.

What to look for

• High-volume IPs that fail: usually a legitimate service missing DKIM.
• Unknown IPs failing everything: likely spoofing, which enforcement will block.
• Forwarders: SPF fails but DKIM passes. That's normal.

Sending reports to another domain

If rua points to a different domain (such as a reporting service), that domain must publish an authorization record at yourdomain.com._report._dmarc.reportingdomain.com containing v=DMARC1. Otherwise receivers won't send the reports.

Forensic (ruf) reports

Few large receivers send per-message failure reports for privacy reasons. Aggregate reports are what matter.

Sources

• RFC 7489: DMARC

This guide is general information, not legal or professional advice. Provider screens change; always confirm the exact values shown in your own account.