DMARC Reporting Explained

DMARC (Domain-based Message Authentication, Reporting and Conformance) is an email authentication protocol that builds on SPF and DKIM. It lets domain owners publish a policy telling receivers what to do when authentication checks fail — and, crucially, it asks receivers to send reports back about every message they see.

What Are DMARC Reports?

DMARC reports come in two types: aggregate (RUA) and forensic (RUF). Aggregate reports are XML files sent daily by mailbox providers like Google, Microsoft, and Yahoo. They summarise authentication results for all messages sent using your domain.

Forensic reports (when available) provide per-message failure details, including headers and authentication results for individual messages that failed DMARC checks.

What Do Aggregate Reports Contain?

• The reporting organisation (e.g., Google, Microsoft)
• Your domain's published DMARC policy
• Source IP addresses sending as your domain
• Message volumes per source
• SPF and DKIM authentication results
• DMARC alignment status (pass or fail)
• Policy actions applied (none, quarantine, reject)

Why Reports Matter

Without reports, you're flying blind. You don't know who is sending email as your domain, whether authentication is working, or whether it's safe to enforce your DMARC policy. Reports give you the visibility you need to identify all senders, fix authentication issues, and move to enforcement with confidence.

The Challenge

Raw DMARC reports are machine-readable XML — not designed for humans. A single domain can receive hundreds of reports per day, each containing thousands of rows. Manually reviewing them is impractical, and most teams simply don't.

This is exactly the problem Safer Sender solves: we parse, normalise, and enrich every report into a clear sender inventory, authentication quality scores, and actionable remediation guidance.