Terms below appear throughout guides on DMARC aggregate reports. Each definition is one or two sentences; follow the links in the sidebar for the full guides.
Core terms#
DMARC aggregate reports
DMARC aggregate (RUA) reports are daily XML files sent by mailbox providers listing, per sending IP, how many messages claimed your domain and whether they passed SPF, DKIM, and alignment. Forensic (RUF) reports contain samples of individual failures.
SPF
A DNS record listing servers authorized to send for a domain. Checked against the connecting IP.
DKIM
A cryptographic signature on each message, verified with a public key in DNS.
DMARC
A policy record telling receivers what to do when SPF and DKIM fail alignment, plus reporting.
Alignment
Agreement between the visible From domain and the domain that passed SPF or DKIM.
Sender reputation
A provider's running assessment of a domain or IP based on complaints, bounces, engagement, and authentication.
Inbox placement
Share of accepted mail that lands in the inbox rather than spam.
Spam trap
An address that never opted in, used to catch senders with poor list practices.
BIMI
A DNS record pointing to a brand logo displayed next to authenticated mail; requires DMARC enforcement.
Feedback loop
A provider program that reports recipient spam complaints back to the sender.
Frequently asked questions#
How do I read a DMARC report?
Each record lists a source IP, message count, SPF and DKIM results, and alignment. Use an analyzer to aggregate by source; the goal is to name every IP range.
Why do I see mail from IPs I do not recognize?
Common causes are forwarding, a vendor you forgot, an employee's personal tool, or spoofing. Volume and geography usually tell them apart.