DMARC reports: what they are and how to read one

When you publish a DMARC record with a reporting address, mail providers start sending you a daily summary of every message that claimed to come from your domain. It arrives as a compressed XML attachment, which is why most people delete it. That is a shame, because it answers a question nothing else can: who is really sending mail in your name?

Turning them on

Add a reporting address to your DMARC record with the rua tag. Use a dedicated mailbox — the reports arrive daily from every large provider, and they are not pleasant reading in your main inbox.

v=DMARC1; p=none; rua=mailto:dmarc@your-store.com

What is inside

Each report covers one day from one provider, and lists every sending server that used your domain. For each one you get the number of messages, whether SPF passed, whether DKIM passed, and whether each was aligned with the domain in the From line.

Alignment is the part people miss. A message can pass SPF and still fail DMARC, because the domain SPF verified belongs to the sending service rather than to you. Both facts appear separately in the report for exactly this reason.

Reading one without special software

Unzip the attachment and open the XML in any text editor. You are looking for three things:

Sources you recognise that are passing — nothing to do.
Sources you recognise that are failing — this is your actual to-do list. A marketing tool or invoicing system whose DKIM was never enabled, or which is missing from your SPF record.
Sources you do not recognise at all — either a forgotten service, or somebody spoofing your domain.

Free web viewers exist that turn the XML into a readable table, and they are worth using if reports become a habit. For a small shop, opening the file once a week for a fortnight is usually enough to build the complete picture.

What to do with what you find

Fix your own failing senders first — that is the whole point of staying at p=none for a couple of weeks. Once every legitimate source passes, tighten the policy to p=quarantine with a percentage, watch, then go to p=reject.

Unfamiliar sources are not automatically attackers. Forwarding services, old newsletter tools and even conference registration systems show up regularly. Investigate before assuming the worst — but do investigate, because spoofing your domain is exactly how phishing aimed at your customers begins.

When you can stop reading them

You never fully stop, but the effort drops sharply. Once you are at p=reject and the sources have been stable for a month, a monthly glance is enough — you are watching for something new appearing, not for something to fix.

Did this answer your question?

If anything here was wrong, unclear or out of date, tell us — the article gets fixed the same day.

Something is missing Back to help centre