Beyond simply publishing a DMARC record, enabling and analyzing DMARC reports gives you real visibility into who's sending email using your domain — including legitimate services you may have forgotten and potential spoofing attempts.
What DMARC Reports Contain
Aggregate reports (sent daily by participating receiving mail servers) show a summary of messages claiming to be from your domain — whether they passed or failed SPF/DKIM authentication, and the sending source's IP address.
Configuring DMARC to Request Reports
_dmarc.yourdomain.com. TXT "v=DMARC1; p=quarantine; rua=mailto:[email protected]; ruf=mailto:[email protected]"rua specifies where aggregate reports are sent; ruf specifies where forensic (failure-specific) reports go, though forensic reports are less universally supported by receiving servers.
Setting Up a Dedicated Mailbox for Reports
Reports can be substantial in volume for active domains — consider a dedicated mailbox specifically for DMARC reports, separate from regular email, keeping them organized and out of your main inbox.
Understanding Report Format
Aggregate reports arrive as XML attachments — not human-friendly to read directly; dedicated DMARC report analysis tools parse these into readable dashboards showing sending sources, pass/fail rates, and trends over time.
Using a DMARC Report Analysis Service
Several free and paid services exist specifically for parsing and visualizing DMARC reports — configure your rua address to point at such a service (many provide a unique receiving address) for an ongoing dashboard rather than manually parsing raw XML.
What to Look for in Reports
- Unexpected sending sources — IPs you don't recognize sending as your domain, potentially indicating spoofing or a forgotten legitimate service
- Legitimate services failing authentication — a third-party service you use (marketing platform, CRM) that hasn't been properly configured with SPF/DKIM
- Overall pass rate trend — should be high and stable for your legitimate sending sources
The Gradual DMARC Enforcement Approach
See How to Configure SPF, DKIM, and DMARC (Complete Guide) for the broader context — use reports specifically to validate your configuration is correct before progressively moving from p=none (monitor only) to p=quarantine to p=reject, avoiding blocking legitimate mail you hadn't accounted for.
Identifying Forgotten Legitimate Senders
A common discovery when first reviewing DMARC reports: legitimate services (a marketing tool, a support ticket system, a CRM) sending as your domain that you'd forgotten needed proper SPF/DKIM configuration — reports surface these before you move to stricter enforcement and accidentally block them.
Reviewing Reports Regularly
Set a regular cadence (weekly, at minimum for actively monitored domains) to review DMARC reports, especially during the period when you're still validating configuration before moving to strict enforcement.
Common Errors
No reports arriving despite correct DNS configuration — verify the rua mailbox actually exists and can receive mail; also allow a few days, since reports are typically sent once daily in aggregate, not immediately.
Continue Reading
- How to Configure SPF, DKIM, and DMARC (Complete Guide)
- How to Monitor Email Deliverability and Sender Reputation
- How to Troubleshoot Email Not Sending or Going to Spam
Browse more articles in Email Hosting & Deliverability.
