DMARC aggregate (RUA) reports are daily XML files sent by mailbox providers listing, per sending IP, how many messages claimed your domain and whether they passed SPF, DKIM, and alignment. Forensic (RUF) reports contain samples of individual failures.
How do I read a DMARC report?
Each record lists a source IP, message count, SPF and DKIM results, and alignment. Use an analyzer to aggregate by source; the goal is to name every IP range.
Why do I see mail from IPs I do not recognize?
Common causes are forwarding, a vendor you forgot, an employee's personal tool, or spoofing. Volume and geography usually tell them apart.
Why does DMARC aggregate reports matter for deliverability?
Reports are the only way to see who is sending as your domain, including vendors you forgot and attackers you never knew about. Moving to p=reject safely depends on reading them.
What is the first step to get started with DMARC aggregate reports?
Publish rua=mailto: pointing to a dedicated mailbox or a report processor.
What is the most common DMARC aggregate reports mistake?
Reading raw XML by hand and giving up after day two.