Back to Course
Լight modeDark mode

How to Read DMARC Reports?

How to enable DMARC reporting for your domains?

To configure DMARC reporting for your domain you need to:

Create a DMARC record for your domain.
In the rua tag, enter the email address where you want your aggregate reports sent.
In the ruf tag, enter the email address where you want your failure reports (historically called forensic reports) sent.
Once you have filled in the other tags and generated the record, publish the resulting TXT record in your DNS.

Note: Failure reports are not sent by all receivers. Most major mailbox providers limit or disable them, so aggregate reports are your most reliable source.

How to Read DMARC Reports: Reading DMARC Raw Reports

Your DMARC reports, also called raw reports, provide the data about your domain's mail activity that you need to protect against spoofing and fix authentication issues. Aggregate reports are available in XML format and are usually sent by email. There are two types:

DMARC aggregate (RUA) report, governed by RFC 9990
DMARC failure (RUF) report, governed by RFC 9991

You can visit PowerDMARC's knowledge base to learn more about each and how to configure them.

Reading raw aggregate reports can be a hassle for a non-technical person. Here is an example of a raw report, reflecting the RFC 9990 format:

<?xml version="1.0" encoding="UTF-8" ?>

<feedback>

  <report_metadata>

    <org_name>google.com</org_name>

    <email>[email protected]</email>

    <extra_contact_info>http://google.com/dmarc/support</extra_contact_info>

    <report_id>8293631894893125362</report_id>

    <date_range>

      <begin>1234453590</begin>

      <end>1234573120</end>

    </date_range>

  </report_metadata>

  <policy_published>

    <domain>yourdomain.com</domain>

    <adkim>r</adkim>

    <aspf>r</aspf> 

    <p>none</p>

    <sp>none</sp>

    <np>none</np>

    <discovery_method>treewalk</discovery_method>

  </policy_published>

  <record>

    <row>

      <source_ip>203.0.113.50</source_ip>

      <count>2</count>

      <policy_evaluated>

        <disposition>none</disposition>

        <dkim>fail</dkim>

        <spf>pass</spf>

      </policy_evaluated>

    </row>

    <identifiers>

      <header_from>yourdomain.com</header_from>

    </identifiers>

    <auth_results>

      <dkim>

        <domain>yourdomain.com</domain>

        <selector>selector1</selector>

        <result>fail</result>

        <human_result></human_result>

      </dkim>

      <spf>

        <domain>yourdomain.com</domain>

        <result>pass</result>

      </spf>

    </auth_results>

  </record>

</feedback>



 

Breaking Down a DMARC Raw Report

Here is what each section means.

The reporting organization, that is, the receiver that generated and sent the report (not your own ISP or email provider):

<org_name>google.com</org_name>

<email>[email protected]</email>

<extra_contact_info>http://google.com/dmarc/support</extra_contact_info>

The report ID:

<report_id>8293631894893125362</report_id>

The reporting date range, in epoch seconds (begin is earlier than end):

<date_range>

  <begin>1234453590</begin>

  <end>1234573120</end>

</date_range>

Your DMARC record, as the receiver retrieved it from DNS. Under RFC 9990, this section now also includes np (the non-existent subdomain policy) and discovery_method, which shows whether the receiver found your policy via the legacy Public Suffix List (psl) or the new DNS Tree Walk (treewalk):

<policy_published>

  <domain>yourdomain.com</domain>

  <adkim>r</adkim>

  <aspf>r</aspf>

  <p>none</p>

  <sp>none</sp>

  <np>none</np>

  <discovery_method>treewalk</discovery_method>

</policy_published>

The IP address of the sending source:

<source_ip>203.0.113.50</source_ip>

The evaluated result for this source (the disposition applied, plus the DKIM and SPF outcomes):

<policy_evaluated>

  <disposition>none</disposition>

  <dkim>fail</dkim>

  <spf>pass</spf>

</policy_evaluated>

The From: domain:

<header_from>yourdomain.com</header_from>

The DKIM authentication result. Under RFC 9990, the DKIM selector is required, which helps you identify exactly which signing key produced the result, useful during key rotation:

<dkim>

  <domain>yourdomain.com</domain>

  <selector>selector1</selector>

  <result>fail</result>

</dkim>

The SPF authentication result:

<spf>

  <domain>yourdomain.com</domain>

  <result>pass</result>

</spf>

DMARC Reporting >How to Read DMARC Reports?
Course content
0%
Advanced Email Authentication Course

How to Read DMARC Reports?