Understanding DMARC reports

DMARC aggregate reports are XML files sent by mailbox providers to the rua address in your DMARC record. They summarize authentication results for messages claiming to come from your domain.

A report usually includes the sending source, message counts, SPF and DKIM results, alignment results, and the policy action applied by the receiver.

Start by separating known senders from unknown sources. Known senders that fail alignment need configuration work. Unknown sources that fail authentication may be spoofing attempts or forgotten systems.

High-volume failures deserve attention first. A small number of failures can come from forwarding or edge cases, but repeated failures from a real vendor usually mean SPF, DKIM, or the From domain is misconfigured.

Reports are most valuable when they guide enforcement. Once legitimate sources consistently pass aligned SPF or DKIM, you can raise the DMARC policy from none to quarantine and eventually reject.

Keep the reporting address active after enforcement. Reports become an early warning system when a new sender is added incorrectly or when an attacker starts abusing your domain.