How to read DMARC aggregate reports (rua)

What it means

When your DMARC record contains a rua= address, receivers like Google, Microsoft and Yahoo send you a daily summary called an aggregate report. It lists every IP address that sent email using your domain, how many emails, and whether they passed SPF and DKIM.

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

The reports arrive as compressed attachments (.zip or .gz) containing an XML file. They are written for machines, but you can read them.

Why it matters

• They show all your senders, including ones you forgot: an invoicing tool, an old server, a colleague's app.
• They reveal people trying to send fake emails with your domain.
• You need them before moving DMARC from p=none to quarantine or reject, to be sure nothing legitimate will be blocked.

The main parts of a report

Who sent the report

In report_metadata: org_name (for example google.com), a report_id and a date_range, usually 24 hours, written as Unix timestamps.

Your published policy

In policy_published: the DMARC record the receiver saw, such as p=none and the alignment modes.

One block per source

Each record describes one sending IP:

<source_ip>203.0.113.10</source_ip>
<count>42</count>
<disposition>none</disposition>
<dkim>pass</dkim>
<spf>fail</spf>
<header_from>yourdomain.com</header_from>

• count: number of emails from this IP.
• disposition: what the receiver did (none, quarantine, reject).
• dkim and spf under policy_evaluated: the DMARC result, which requires the domain to match your From domain. One pass is enough for DMARC to pass.
• auth_results: the raw SPF and DKIM checks, with the domain that was actually checked. Compare it with header_from to understand alignment failures.

How to use them

1. Identify each IP. Look up its reverse DNS name or owner. Names like google.com, outlook.com or your newsletter tool's domain are usually yours.
2. Sort into three groups:
   • Your services, passing: nothing to do.
   • Your services, failing: add them to SPF, or set up DKIM with your domain in that service.
   • Unknown IPs failing everything: probably spoofing. Your future reject policy will block them.
3. Watch the trend for a few weeks before tightening your policy.

Note: forwarded emails and mailing lists often show up as failures from IPs you do not know. A small number is normal.

Make it easier

Reading XML by hand gets tedious once you receive many reports. Use a dedicated mailbox for rua, and consider a tool that collects and summarises the reports. The paid dashboard's DMARC monitoring does this for your domains.

Check that it is working

Scan your domain at /domain-scanner to confirm the DMARC record has a valid rua address. Reports usually start arriving within a day or two, from the providers your recipients use.