DMARC aggregate (RUA) reports are daily XML files sent by mailbox providers listing, per sending IP, how many messages claimed your domain and whether they passed SPF, DKIM, and alignment. Forensic (RUF) reports contain samples of individual failures.
A correct example#
<record>
<row><source_ip>203.0.113.10</source_ip><count>412</count>
<policy_evaluated><disposition>none</disposition><dkim>pass</dkim><spf>fail</spf></policy_evaluated></row>
<identifiers><header_from>example.com</header_from></identifiers>
</record>Every element is there for a reason, and each maps to one of the setup steps below.
What good looks like#
- Done: Publish rua=mailto: pointing to a dedicated mailbox or a report processor.
- Done: Collect reports for at least two weeks before drawing conclusions.
- Done: Group sources by IP owner and match each to a known vendor.
- Done: Fix alignment for legitimate sources; treat unknown high-volume sources as spoofing.
- Done: Track pass rate weekly and tighten policy as it approaches 100%.
What bad looks like#
- Seen in audits: Reading raw XML by hand and giving up after day two.
- Seen in audits: Ignoring low-volume unknown sources that turn out to be your own systems.
- Seen in audits: Expecting RUF reports; most large providers no longer send them.
How to move from bad to good#
Work through the good list in order and re-verify after each change. Most teams find one or two items from the bad list already present; fixing those usually produces the largest improvement.
Frequently asked questions#
How do I read a DMARC report?
Each record lists a source IP, message count, SPF and DKIM results, and alignment. Use an analyzer to aggregate by source; the goal is to name every IP range.
Why do I see mail from IPs I do not recognize?
Common causes are forwarding, a vendor you forgot, an employee's personal tool, or spoofing. Volume and geography usually tell them apart.