5 min read
How to read DMARC reports
What aggregate and forensic reports contain, and what to look for first.
Aggregate reports (rua)
Mailbox providers send an XML file, usually once a day, covering the mail they received that claimed to be from your domain. The file is often compressed as zip or gzip.
Each row groups messages by sending IP address and gives a count, the policy the receiver applied, and the SPF and DKIM results, both raw and aligned. There is no message content in these reports.
What to look at first
Sort by volume. The biggest senders should be services you know. Then look at the rows that fail: is it a legitimate service that is missing from SPF or not signing with DKIM, or is it a server you do not recognise?
Servers you do not recognise that send small volumes and fail are usually forgery attempts. Servers you do recognise that fail are your to-do list.
Forensic reports (ruf)
Forensic, or failure, reports describe individual messages that failed, and may include headers and part of the message. Because they can contain personal data, many receivers do not send them at all, and those that do may redact them. Treat them as a bonus where you get them, not something to rely on.
Why a tool helps
A busy domain receives dozens of these files a day, and each lists servers by IP. Turning that into a named list of services, with the change in volume since last week, is the work that makes reports usable.