--- title: "DMARC RUA Vs. RUF Reports | DMARC Report" description: "DMARC is not just about creating a record and defining DMARC policies." image: "https://dmarcreport.com/og/blog/dmarc-rua-vs-ruf-reports.png" canonical: "https://dmarcreport.com/blog/dmarc-rua-vs-ruf-reports/" --- Quick Answer DMARC is not just about creating a record and defining DMARC policies. You have to gain insights into how it works and figure out if your record needs any advancements or demotions. This careful analysis is done by adding RUA and RUF tags to a record, followed by email addresses where you want to receive these reports. Related: [Free DMARC Checker](/tools/dmarc-checker/) Share [ ](https://www.linkedin.com/sharing/share-offsite/?url=undefined%2Fblog%2Fdmarc-rua-vs-ruf-reports%2F "Share on LinkedIn") [ ](https://twitter.com/intent/tweet?text=DMARC%20RUA%20Vs.%20RUF%20Reports&url=undefined%2Fblog%2Fdmarc-rua-vs-ruf-reports%2F "Share on X/Twitter") [ ](https://www.facebook.com/sharer/sharer.php?u=undefined%2Fblog%2Fdmarc-rua-vs-ruf-reports%2F "Share on Facebook") [ ](https://reddit.com/submit?url=undefined%2Fblog%2Fdmarc-rua-vs-ruf-reports%2F&title=DMARC%20RUA%20Vs.%20RUF%20Reports "Share on Reddit") [ ](mailto:?subject=DMARC%20RUA%20Vs.%20RUF%20Reports&body=Check out this article: undefined%2Fblog%2Fdmarc-rua-vs-ruf-reports%2F "Share via Email") ![DMARC Report blog post image](https://media.mailhop.org/dmarcreport/images/2023/12/dmarc-report-4.jpg) ## Try Our Free DMARC Checker Validate your DMARC policy, check alignment settings, and verify reporting configuration. [ Check DMARC Record → ](/tools/dmarc-checker/) [DMARC](/) is not just about creating a record and defining [DMARC policies](/blog/what-is-a-dmarc-policy-and-how-does-it-affect-sending-my-emails/). You have to gain insights into how it works and figure out if your record needs any advancements or demotions. This careful analysis is done by **adding RUA and RUF tags** to a record, followed by email addresses where you want to receive these reports. This guide dives deep into RUA vs RUF reports. ## DMARC RUA Report In the first leg of this guide on RUA vs RUF reports, let’s see what is a DMARC RUA report and why do you need it. So, the RUA report is short for aggregate report, and it includes information concerning your email-sending domain’s traffic. You get an overview of how emails come in and go out of your company. These [DMARC RUA reports](/dmarc-aggregate-reports/) give you a bird’s-eye view of every stream sending as your domain. This general report doesn’t contain any sensitive information and is only meant to help you figure out the instances of false and [true positives](https://nordvpn.com/cybersecurity/glossary/true-positives/#:~:text=In%20a%20spam%20filter%2C%20true,and%20blocks%20an%20unwanted%20email.). If analyzed proficiently, it prevents phishing and [domain spoofing attacks](https://web.archive.org/web/20260203032621/https://cointelegraph.com/news/coinbase-domain-name-reportedly-used-by-scammers-in-high-profile-attacks). A [DMARC XML parser tool](/tools/dmarc-report-analyzer/) makes that analysis practical instead of manual. ## Inclusions of a DMARC RUA Report RUA vs RUF reports contain different details, so you must choose to receive both of them for the fruition of the DMARC monitoring exercise. This is what a [DMARC RUA report](/dmarc-report/) contains- ### Failed Authentication Details This section has the sending server’s IP address, the authenticated domain, and certain authentication mechanisms that fail the [SPF](/dmarc-fundamentals/what-is-spf/) and/or DKIM filters. ![potential risks associated with emailing](https://media.mailhop.org/dmarcreport/images/2023/12/dmarc-alignment-6478.jpg) ### Message Headers By reading message headers, you can **trace malicious entities** and identify [potential risks associated with emailing](https://web.archive.org/web/20251107151256/https://cobidu.co.uk/blog/e-mail-security-are-you-aware-of-the-potential-risks-of-e-mails-). ### Authentication-Results Information on if a message has passed or failed the [SPF and DKIM authentication checks](/blog/how-to-check-if-your-email-authentication-is-set-up-correctly-for-dkim-dmarc-spf-bimi/). It also highlights occurrences of relevant error messages. ### Message Count This gives a **count of messages** that didn’t go through the SPF and DKIM filters. ### Policy Evaluation _It highlights how the recipients’ servers treated the messages that failed the authentication checks_. ## Working of the ‘RUA’ Tag Reliable [DMARC reporting](/dmarc-report/) depends on getting these tags right. Email servers that receive messages regularly send RUA reports to all domains with a properly configured [DMARC policy](/lessons/defining-a-dmarc-policy/). These reports comprise **encrypted aggregate statistics** in XML format and are directed to the email address(es) specified after **“mailto:” in the RUA tag** of your DMARC record. To clarify, the RUA tag serves the purpose of specifying one or more **email addresses** where you wish to receive [DMARC Aggregate Reports](/dmarc-aggregate-reports/). _It includes a comma-separated list of email addresses prefixed with “mailto:” to designate the recipients for the DMARC Aggregate Reports_. Here’s an example of a DMARC record illustrating the use of the RUA tag: v=DMARC1; p=none; RUA=mailto:[message1@domain.com](mailto:message1@domain.com) **Decoding the XML reports** may be challenging for the ones who aren’t from a core technical background. So, it’s better to seek help from online [DMARC report](/understanding-dmarc-reports/) analyzing tools to gather, filter, and organize the reports for easy examination in a human-readable format; basically, it’s just plain English. A dedicated [DMARC analyzer](/blog/free-dmarc-report-analyzer-xml-parser-2026/) does exactly this, parsing the XML into a clear summary. _Please note that the email address you enter in the RUA tag field should actually be authorized to receive these reports_. Otherwise, the process would fail to work. Also, you can choose to receive these reports on an email address that belongs to a different domain. In simpler terms, you can choose to receive **RUA vs RUF reports** of the example.com domain to anotherdomain.com. This is called [external domain verification](/blog/the-concept-of-external-domain-verification-in-dmarc-reporting/). ![Configure Domains](https://media.mailhop.org/dmarcreport/images/2023/12/gmail-dmarc-9.jpg) ## DMARC RUF Report The concept of RUF reports was introduced to allow domain owners to take the benefit of a redacted copy of emails that failed [DMARC compliance](/blog/mandatory-requirement-dmarc-compliance-included-in-pci-dss-version-4-0/). Think of it as a comprehensive and detailed dossier that includes **full-length details** of unauthenticated messages so that you can try tracing back the culprit. It also helps to analyze the wrongdoings that cause false positives for genuine email senders. ## Inclusions of a DMARC RUF Report RUA vs RUF reports have different details. Here’s what the latter one contains- ### Authentication-Results You get details on whether a message has passed or failed SPF and [DKIM](/dmarc-fundamentals/what-is-dkim/) checks. It takes domain owners through their domain’s email utility patterns. ### Message Headers It entails details on the **email sender**, recipient, subject line, and timestamps to understand the context of failed messages dispatched from your domain. This way, you get to evaluate the story behind [false positives](https://www.timesnownews.com/technology-science/apple-finally-speaks-out-those-state-sponsored-cyber-alerts-on-iphones-could-be-false-alarms-article-104849139) and make adjustments in your DMARC record accordingly. ### Message Content Domain owners can examine the contents of suspicious messages in order to identify and investigate potential wrongdoers, if feasible. _Analyzing links and attachments assists in establishing connections and understanding the overall context_. ### Encryption Details [RUF reports](/blog/how-to-fix-dmarc-ruf-report-problems/) are sent in encrypted form to avoid their exploitation. ## Working of the ‘RUA’ Tag RUF or [DMARC forensic reports](/dmarc-forensic-report/) are dispatched in cases where an email claiming to be from your domain does not pass **DMARC authentication**. If there is a failure in [SPF and DKIM alignment](/topic/spf-dkim-alignment-defined/), the [Internet Service Provider](https://en.wikipedia.org/wiki/Internet%5Fservice%5Fprovider) generates a forensic report, signaling an issue with a sending IP. Similar to RUA reports, RUF reports are directed to the email address specified in the RUF tag of your [DMARC record](/dmarc-record/), following the “mailto:” format. These reports offer insights into the reasons behind the failure of some legitimate messages and provide visibility into how **unauthorized IPs** using your domain structure their messages. The nature of the failure is indicated by the ‘fo’ tag, while the designated email address for **receiving RUF reports** is specified in the ‘RUF’ tag. For instance: v=DMARC1; p=reject; RUA=mailto:[email1@yourdomain.com](mailto:email1@yourdomain.com);RUF=mailto:[message2@domain2.com](mailto:message2@domain2.com); sp=none; fo=0; ## Final Words [DMARC reporting and monitoring](/blog/top-easydmarcs-dmarc-report-monitoring-alternatives/) completes the whole process of [email security](/blog/why-is-email-security-important-for-businesses-today-2/) and authentication. We at DMARCReport offer **on-demand compliance** for organizations functioning under the European GDPR structure to ensure smooth operations and no regulatory issues. Visit our knowledge support center before getting started. ## Topics [ DMARC ](/tags/dmarc/)[ dmarc record ](/tags/dmarc-record/)[ dmarc report ](/tags/dmarc-report/)[ email security ](/tags/email-security/) ![Brad Slavin](https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg) [ Brad Slavin ](/authors/brad-slavin/) General Manager Founder and General Manager of DuoCircle. Product strategy and commercial lead for DMARC Report's 2,000+ customer base. [LinkedIn Profile →](https://www.linkedin.com/in/bradslavin) ## Take control of your DMARC reports Turn raw XML into actionable dashboards. Start free - no credit card required. [Start Free Trial](https://app.dmarcreport.com/signup?plan=free) [Check Your DMARC Record](/tools/dmarc-checker/) Scan Your Domain Now Instantly scan your domain for DKIM, SPF, and DMARC issues Check My Domain Share this article [ ](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fdmarcreport.com%2Fblog%2Fdmarc-rua-vs-ruf-reports%2F) [ ](https://twitter.com/intent/tweet?text=DMARC%20RUA%20Vs.%20RUF%20Reports&url=https%3A%2F%2Fdmarcreport.com%2Fblog%2Fdmarc-rua-vs-ruf-reports%2F) [ ](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fdmarcreport.com%2Fblog%2Fdmarc-rua-vs-ruf-reports%2F) Copy Related Articles - [ ![Email Security](https://media.mailhop.org/dmarcreport/images/2025/10/dmarc-check-5211.jpg) Best DMARC Tools for 2025 Uncategorized ](/blog/best-dmarc-tools-for-2025/) - [ ![dmarc](https://media.mailhop.org/dmarcreport/images/2026/05/dmarc-lookup-9637.jpg) Best Free DMARC Monitoring Tools in 2026: A Complete Guide to Starting DMARC Monitoring Without Budget Approval Uncategorized ](/blog/best-free-dmarc-monitoring-tools-2026-guide-without-budget-approval/) - [ ![dmarc](https://media.mailhop.org/dmarcreport/images/2026/03/dmarc-check-5091.jpg) Complete Guide to Setting Up a DMARC Policy for Gmail Domains Uncategorized ](/blog/complete-guide-to-setting-dmarc-policy-for-gmail-domains/) - [ ![Msps And Service Providers](https://media.mailhop.org/dmarcreport/images/2025/08/what-is-dmarc-6654.jpg) Comprehensive Guide To DMARC Monitoring Services For Msps And Service Providers Uncategorized ](/blog/comprehensive-guide-to-dmarc-monitoring-for-msps-and-service-providers/) ## Related Articles [ Uncategorized 8m Best DMARC Tools for 2025 Oct 9, 2025 ](/blog/best-dmarc-tools-for-2025/)[ Uncategorized 17m Best Free DMARC Monitoring Tools in 2026: A Complete Guide to Starting DMARC Monitoring Without Budget Approval May 5, 2026 ](/blog/best-free-dmarc-monitoring-tools-2026-guide-without-budget-approval/)[ Uncategorized 11m Complete Guide to Setting Up a DMARC Policy for Gmail Domains Mar 16, 2026 ](/blog/complete-guide-to-setting-dmarc-policy-for-gmail-domains/)[ Uncategorized 12m Comprehensive Guide To DMARC Monitoring Services For Msps And Service Providers Aug 26, 2025 ](/blog/comprehensive-guide-to-dmarc-monitoring-for-msps-and-service-providers/) ```json {"@context":"https://schema.org","@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com","logo":{"@type":"ImageObject","url":"https://dmarcreport.com/images/dmarcreport-logo.png"},"description":"DMARC reporting and email authentication management. Monitor aggregate and forensic DMARC reports, analyze authentication results, and enforce DMARC policies across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138898167","https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://www.g2.com/products/dmarc-report/reviews","https://github.com/duocircle","https://www.crunchbase.com/organization/duocircle-llc","https://www.trustradius.com/products/duocircle/reviews"],"aggregateRating":{"@type":"AggregateRating","ratingValue":"4.8","reviewCount":"471","bestRating":"5","worstRating":"1","url":"https://www.g2.com/products/dmarc-report/reviews"},"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://dmarcreport.com/support/"},"knowsAbout":["DMARC","DMARC Reporting","DMARC Aggregate Reports","DMARC Forensic Reports","Sender Policy Framework","DKIM","Email Authentication","Email Security","DNS Management","Email Deliverability"]} ``` ```json {"@context":"https://schema.org","@type":"WebSite","name":"DMARC Report","url":"https://dmarcreport.com","description":"DMARC reporting and email authentication management. Monitor aggregate and forensic DMARC reports, analyze authentication results, and enforce DMARC policies across all your domains.","publisher":{"@type":"Organization","name":"DMARC Report","url":"https://dmarcreport.com","logo":{"@type":"ImageObject","url":"https://dmarcreport.com/images/dmarcreport-logo.png"},"description":"DMARC reporting and email authentication management. Monitor aggregate and forensic DMARC reports, analyze authentication results, and enforce DMARC policies across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}}} ``` ```json [{"@context":"https://schema.org","@type":"BlogPosting","headline":"DMARC RUA Vs. RUF Reports","description":"DMARC is not just about creating a record and defining DMARC policies.","url":"https://dmarcreport.com/blog/dmarc-rua-vs-ruf-reports/","datePublished":"2023-12-14T20:05:00.000Z","dateModified":"2025-06-09T12:44:26.000Z","dateCreated":"2023-12-14T20:05:00.000Z","author":{"@type":"Person","@id":"https://dmarcreport.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://dmarcreport.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin is the founder and General Manager of DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. He founded DuoCircle in 2014 and has led the company's growth to 2,000+ customers across its email security product family. Brad's focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DMARC Report","url":"https://dmarcreport.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com","logo":{"@type":"ImageObject","url":"https://dmarcreport.com/images/dmarcreport-logo.png"},"description":"DMARC reporting and email authentication management. Monitor aggregate and forensic DMARC reports, analyze authentication results, and enforce DMARC policies across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138898167","https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://www.g2.com/products/dmarc-report/reviews","https://github.com/duocircle","https://www.crunchbase.com/organization/duocircle-llc","https://www.trustradius.com/products/duocircle/reviews"],"aggregateRating":{"@type":"AggregateRating","ratingValue":"4.8","reviewCount":"471","bestRating":"5","worstRating":"1","url":"https://www.g2.com/products/dmarc-report/reviews"},"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://dmarcreport.com/support/"},"knowsAbout":["DMARC","DMARC Reporting","DMARC Aggregate Reports","DMARC Forensic Reports","Sender Policy Framework","DKIM","Email Authentication","Email Security","DNS Management","Email Deliverability"]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://dmarcreport.com/blog/dmarc-rua-vs-ruf-reports/"},"articleSection":"uncategorized","keywords":"DMARC, dmarc record, dmarc report, email security","wordCount":993,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/dmarcreport/images/2023/12/dmarc-report-4.jpg","caption":"DMARC Report blog post image","width":1000,"height":516},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}}] ``` ```json {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://dmarcreport.com/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https://dmarcreport.com/blog/"},{"@type":"ListItem","position":3,"name":"Uncategorized","item":"https://dmarcreport.com/uncategorized/"},{"@type":"ListItem","position":4,"name":"DMARC RUA Vs. RUF Reports","item":"https://dmarcreport.com/blog/dmarc-rua-vs-ruf-reports/"}]} ```