When you publish a DMARC record with a rua tag, mailbox providers start sending you a daily summary of what they saw. These are the reports that tell you what is really sending mail as your domain.
How to ask for them
Add rua to the record:
v=DMARC1; p=none; rua=mailto:[email protected]Use an address you read, or one run by a report service. The reports arrive as compressed XML attachments.
What is inside
Each report covers one provider for one day and lists, per sending IP address:
- how many messages it sent using your domain,
- whether they passed SPF and DKIM, and whether they were aligned,
- what the receiver did with them under your policy.
Why you want them
- To find every service that sends as you, including ones you forgot.
- To spot spoofing attempts.
- To confirm it is safe to move from
p=noneto enforcement.
Using them
The XML is unreadable in practice. A dozen providers each send a file a day, so most people use a service that collects and charts them. Without one, you can read a single report by eye, but you cannot watch a trend.
Reports and Amazon SES
Your SES mail shows up in the reports under the SES sending IP addresses. If those lines show a failure, check DMARC alignment first. A pass with SES but a failure from another tool is common, and it is exactly what reports are for.
Common questions
How often do I get aggregate reports?
Usually once a day from each provider that supports them. Large providers send them, smaller ones may not.
What is the difference between rua and ruf?
rua requests aggregate reports, which summarise results. ruf requests forensic reports about individual failures. Many providers do not send forensic reports because they can contain message content.