--- title: "How Can I Monitor And Receive Alerts When DMARC Alignment Breaks For My Domains? | DMARC Report" description: "Monitor DMARC alignment and receive instant alerts when authentication breaks, helping you quickly detect spoofing, misconfigurations, and deliverability risks." image: "https://dmarcreport.com/og/blog/how-to-monitor-dmarc-alignment-breaks-and-receive-domain-alerts.png" canonical: "https://dmarcreport.com/blog/how-to-monitor-dmarc-alignment-breaks-and-receive-domain-alerts/" --- Quick Answer Use a DMARC monitoring solution to track alignment across your domains and receive real-time alerts when SPF or DKIM alignment fails. This helps identify spoofing, misconfigurations, and deliverability issues quickly. Share [ ](https://www.linkedin.com/sharing/share-offsite/?url=undefined%2Fblog%2Fhow-to-monitor-dmarc-alignment-breaks-and-receive-domain-alerts%2F "Share on LinkedIn") [ ](https://twitter.com/intent/tweet?text=How%20Can%20I%20Monitor%20And%20Receive%20Alerts%20When%20DMARC%20Alignment%20Breaks%20For%20My%20Domains%3F&url=undefined%2Fblog%2Fhow-to-monitor-dmarc-alignment-breaks-and-receive-domain-alerts%2F "Share on X/Twitter") [ ](https://www.facebook.com/sharer/sharer.php?u=undefined%2Fblog%2Fhow-to-monitor-dmarc-alignment-breaks-and-receive-domain-alerts%2F "Share on Facebook") [ ](https://reddit.com/submit?url=undefined%2Fblog%2Fhow-to-monitor-dmarc-alignment-breaks-and-receive-domain-alerts%2F&title=How%20Can%20I%20Monitor%20And%20Receive%20Alerts%20When%20DMARC%20Alignment%20Breaks%20For%20My%20Domains%3F "Share on Reddit") [ ](mailto:?subject=How%20Can%20I%20Monitor%20And%20Receive%20Alerts%20When%20DMARC%20Alignment%20Breaks%20For%20My%20Domains%3F&body=Check out this article: undefined%2Fblog%2Fhow-to-monitor-dmarc-alignment-breaks-and-receive-domain-alerts%2F "Share via Email") ![DMARC Alignment](https://media.mailhop.org/dmarcreport/dmarc-check-4416-1784542769073.jpg) ## Try Our Free DMARC Checker Validate your DMARC policy, check alignment settings, and verify reporting configuration. [ Check DMARC Record → ](/tools/dmarc-checker/) You can monitor and receive alerts when [DMARC alignment](https://dmarcreport.com/blog/what-is-dmarc-alignment-and-how-does-it-work/) breaks by enabling DMARC aggregate (rua) and forensic (ruf) reporting in DNS, routing those reports to DMARCReport for parsing and correlation, configuring alignment-failure thresholds and anomaly rules, and integrating DMARCReport’s alerting with your SIEM/Slack/PagerDuty so you get timely notifications scoped to each domain, subdomain, and sender. DMARC alignment breaks when the visible From domain in a message fails to align with SPF’s RFC5321 MailFrom domain or DKIM’s d= domain according to your DMARC policy (relaxed or strict). Because alignment can fail intermittently (misconfigured senders, forwarding, expired keys), you need both coverage (all domains and subdomains) and speed (near-real time where possible) to **separate noise from true impacts**. _Aggregate reports provide population-level visibility every 24 hours, while forensic/failure samples and MTA telemetry provide faster, albeit sparser, signals_. DMARCReport operationalizes this workflow end-to-end: it supplies hosted rua/ruf mailboxes, ingests and normalizes XML reports, correlates them by organizational domain and sender, runs real-time and batch detection, and drives alerts to the right channel with rich diagnostics. The result is fewer false positives, faster triage, and a durable audit trail mapped to your domains, subdomains, and third-party platforms. ## Collecting the right signals: DNS steps for DMARC rua and ruf ### Configure DMARC for each domain and subdomain - Add a [TXT record](https://en.wikipedia.org/wiki/TXT%5Frecord) at `_dmarc.yourdomain.com` with rua and optional ruf mailboxes. - Start with p=none to observe, then move to quarantine/reject once aligned. - Use sp= to control subdomain policy, and set adkim/aspf to **your desired alignment mode**. Example (observation phase): ``` _dmarc.example.com. 3600 IN TXT "v=DMARC1; p=none; sp=quarantine; adkim=r; aspf=r; rua=mailto:rua@dmarcreport.example; ruf=mailto:ruf@dmarcreport.example; fo=1; ri=86400; pct=100" ``` - **rua**: Aggregate XML reports (daily, batched). DMARCReport provides dedicated, high-throughput addresses and verifies DNS ownership automatically. - **ruf**: Forensic failure samples (AFRF). Many large providers restrict ruf for privacy; DMARCReport supplements with alignment telemetry and anomaly models to bridge gaps. #### Practical tips - Use a dedicated reporting domain (e.g., reports.example) with [MX records](https://www.cloudns.net/wiki/article/12/) that point to DMARCReport’s collectors to avoid mixing with user mail. - Set ri=86400 to receive daily aggregates; shorten (e.g., 3600) only for short-term debugging. - Keep TTL at 1 hour during rollout for agility; move to 24 hours once stable. ### Validate DNS and flow - DMARCReport’s DNS Assistant verifies TXT syntax, rua/ruf deliverability, and alignment mode consistency (adkim/aspf vs policy). - Send test messages from each sender (ESP, CRM, product mail, HR) to ensure they appear in incoming rua **XML within 24–36 hours**. ![Tools that detect DMARC failures: open-source vs commercial](https://media.mailhop.org/dmarcreport/dmarc-lookup-6385-1784542923268.jpg) ## Tools that detect DMARC failures: open-source vs commercial ### Landscape overview and trade-offs _Below is a concise comparison of popular approaches you can mix and match_. DMARCReport is highlighted as the managed path. | Tool/Service | Signal Freshness | Accuracy | Scale/Cost | Integration Complexity | Notes | | ---------------------------------------------------- | -------------------------------------------- | ----------------------------- | ------------------- | ---------------------- | --------------------------------------------------------------------------------- | | parsedmarc (open-source) | Daily (rua), limited ruf | High with tuning | Low cost infra; DIY | Medium–High | Runs on Elastic/Timeseries; you own parsing and alerting. | | OpenDMARC + opendmarc-reports | MTA-time + daily reports | Good for local mail | Low; DIY | High | Useful if you run your own MTA; less helpful for cloud mailbox providers. | | Vendor platforms (dmarcian, Valimail, OnDMARC, etc.) | Daily + some near real-time | High | Subscription | Low–Medium | Managed parsing, dashboards, alerts. | | DMARCReport | Daily rua + near real-time signals and dedup | High with built-in heuristics | Predictable tiers | Low | Turnkey collection, normalized analytics, rich alerting, and incident automation. | Key trade-offs: - **Freshness vs coverage**: rua is comprehensive but delayed; ruf is fast but sparse. DMARCReport blends rua with telemetry, anomaly detection, and selective ruf where available. - **Cost vs control**: open-source saves license fees but adds data engineering and maintenance. DMARCReport offloads parsing/normalization/SLA, ideal beyond a few domains. - **Integration**: vendor platforms simplify SIEM/PagerDuty/Slack routing. DMARCReport provides **one-click connectors and webhook** [API (Application Programming Interface)](https://www.ibm.com/think/topics/api) for custom pipelines. ## Designing robust alerting: thresholds that reduce noise ### Core alert rules - **Percent failure threshold**: Alert when **alignment-fail rate** exceeds X% over Y minutes/hours. - **Sudden spike detection**: Alert on deviations from baseline (e.g., 3x median last 7 days). - **Sustained failure windows**: Alert when failure >X% persists for N consecutive intervals. - **Absolute volume guardrails**: Trigger when failures exceed a fixed count (e.g., >500 events in 30 minutes) to catch high-volume campaigns. DMARCReport’s Alert Studio lets you set: - Separate thresholds for root domains vs subdomains and for known third-party senders. - Conditional logic by policy state (p=none vs p=quarantine/reject). - Severity tiers (warning at 5%, critical at 15%) and rate limits to avoid alert storms. #### Reducing false positives - Whitelist benign forwarders and known mailing lists; treat ARC=pass as a softening signal. - Require **both SPF and DKIM** misalignment to trigger high-severity alerts when policy is p=none. - Use vendor tagging to avoid punishing new but approved senders before their DKIM/SPF is live. ## Incident workflows and automation ### Integrations that shorten MTTR - **SIEM (Splunk, Elastic)**: Stream normalized events with alignment outcomes, source IP, envelope-from, header-from, d=, s=, and DMARC disposition. DMARCReport ships ready-made Splunk TAs and Elastic ingestion pipelines. - **ChatOps (Slack/Teams)**: DMARCReport posts compact alerts with inline triage buttons (acknowledge, create ticket, view source). - **On-call (PagerDuty/Opsgenie)**: Route only high-severity, sustained alignment breaks; DMARCReport supports service-based routing and maintenance windows. - **Ticketing (Jira/ServiceNow)**: Auto-create tickets enriched with diagnostics and suggested remediation playbooks. ### Automating follow-up safely - **DKIM key rotation reminders**: DMARCReport detects selectors nearing expiration and opens maintenance tasks. - **SPF governance**: Auto-generate pull requests or change tickets to flatten records or add vendor includes (with human approval). - **Vendor drift**: If a third-party sender begins failing alignment, DMARCReport can pause alerts after the first burst and notify the vendor contact automatically. ## Domain, subdomain, and third‑party nuances ### Root vs subdomain - Root domain (example.com) often aggregates brand mail; subdomains (news.example.com, billing.example.com) map to specific platforms. - Use sp= to enforce or relax subdomain policy. Monitor separately: a marketing subdomain might have different expected alignment **rates than transactional mail**. _DMARCReport tags each message by organizational domain, exact subdomain, and sender platform so alerts target the responsible owner_. ### Third‑party senders - ESPs/CRMs must sign DKIM with your domain (`d=example.com`) and send from approved IPs that pass SPF alignment (envelope-from aligned). - **Common pitfall**: vendors sign DKIM with their domain; with adkim=s, this breaks. DMARCReport’s vendor catalog detects mismatches and recommends configuration corrections or strict→relaxed exceptions. ### Strict vs relaxed alignment - aspf/adkim=r (relaxed) tolerates subdomain differences; =s (strict) requires exact match. - DMARCReport simulates what-if impacts of changing alignment modes before you flip the switch. ![Common causes of apparent alignment breaks and what to include in alerts](https://media.mailhop.org/dmarcreport/dmarc-record-8599-1784543005241.jpg) ## Common causes of apparent alignment breaks and what to include in alerts ### Frequent misconfigurations - **SPF 10-lookup limit and record overflow**: Too many includes/mechanisms cause permerror. Remedy by **flattening or consolidating vendors**. - **Stale DKIM selectors**: Rotated or expired keys not published; mismatched s=. - **From header mismatches**: [Email Service Provider (ESP)](https://www.activecampaign.com/glossary/email-service-provider) using `from=marketing.example.com` while DKIM `d=example.com` and aspf=s. - **Forwarding/mailing lists**: Rewrites break SPF; DKIM may survive. ARC can mitigate. - **NATed/shared IP drift**: Provider sends from unlisted IP ranges. ### Diagnostic fields that speed triage Each alert from DMARCReport includes: - **Source**: IP, reverse DNS, AS, geo - **Identities**: header-from, envelope-from, DKIM d=/s=, Return-Path - **Results**: spf result (pass/fail/softfail/permerror), dkim result, alignment outcomes, DMARC disposition - **Volume**: message count, percent of traffic affected - **Context**: known sender tag, policy state, recent change events (DNS edits, key rotations) - **Recommended next steps**: e.g., “Add `include:_spf.vendor.com`” or “Ask ESP to sign DKIM with `d=example.com`” ## Scaling to hundreds or thousands of domains ### Record design and endpoints - Standardize a DMARC template with versioned comments and a change log. - Route all rua to a centralized collector (e.g., `rua=mailto:org-rua@dmarcreport.example`) and optionally mirror to a second address for redundancy. - Use unique ruf per environment (prod/stage) to test safely. - Maintain a domain inventory with ownership metadata; DMARCReport auto-discovers domains via zone scans and WHOIS, and auto-enrolls them with per-domain tags. ### Aggregation pipelines at scale - **Ingest**: Accept zipped XML over SMTP; **checksum and deduplicate**. - **Parse/normalize**: Convert to a canonical schema: {`org_domain`, `header_from`, aspf/adkim, spf/dkim/alignment, `source_ip`, count, disposition, policy, `time_window`}. - **Store**: Append-only, partitioned by `org_domain` and date for fast queries; DMARCReport manages retention tiers (hot/warm/archival) with configurable [service level agreement (SLA)](https://www.coursera.org/in/articles/sla). ## Building historical analytics, SLAs, and investigations ### Parsing, normalization, retention - Normalize provider names, collapse IPs to netblocks/ASNs, and enrich with vendor tags and geos. - Retain at least 13 months to capture seasonal patterns, with rollups for 24+ months. - DMARCReport applies schema versioning to keep dashboards stable as vendors change report formats. ### Dashboarding that matters - Alignment rate by domain, subdomain, and sender over time with control limits. - Top failing sources, classified by misconfig vs suspicious. - **Policy impact simulator**: expected rejects if you moved from p=none to p=reject. - **SLA metrics**: time-to-detect, time-to-mitigate, and percentage of authenticated mail by business unit. ## Safe testing and validation ### Simulations and dry runs - Use p=none with fo=1 in a new domain to capture failures **without impacting delivery.** - Send test mail with intentionally misaligned [DKIM](https://dmarcreport.com/what-is-dkim/) (`d=wrong.example`) or unlisted SPF IPs from sandboxed hosts. - DMARCReport’s Sandbox Mode replays synthetic rua data and emits “would-alert” notifications to validate thresholds and routing without paging on-call. ### Change management - Stage DNS edits with short [Time-To-Live(TTLs)](https://www.cloudflare.com/learning/cdn/glossary/time-to-live-ttl/); verify with DMARCReport’s instant policy diff and “expected effect” estimate. - Run tabletop exercises: inject a 20% failure spike for a vendor to practice triage. ![Privacy, security, and compliance considerations](https://media.mailhop.org/dmarcreport/what-is-dmarc-8593-1784543082765.jpg) ## Privacy, security, and compliance considerations ### Handling sensitive data - Forensic reports may contain message snippets; restrict ruf to a minimal, controlled mailbox and redact where possible. - Enforce [Transport Layer Security (TLS)](https://ironscales.com/glossary/transport-layer-security) for report receipt; DMARCReport supports opportunistic TLS with cipher controls and per-tenant keys. - Apply [Role-Based Access Control (RBAC)](https://www.techtarget.com/searchsecurity/definition/role-based-access-control-RBAC) and least privilege; DMARCReport integrates with SSO and audit logs to track access. ### Governance - **Data minimization**: Retain ruf for shorter periods than rua; mask PII in alerts. - **DNS TTL choices**: Short for rollout (faster rollback), longer for stability; document all changes. - **Vendor agreements**: Ensure DPAs are in place with report processors; DMARCReport provides regional [data residency](https://www.ibm.com/think/insights/data-residency-why-is-it-important) **options and configurable retention**. ## Original data and case studies ### Insight: Detection latency reality _Across mixed mailbox providers, 70–85% of aggregate (rua) volume typically arrives within 24 hours, 90–95% within 36 hours; outliers can take 72 hours_. DMARCReport accounts for this by complementing fraud-based alerts with near real-time telemetry and anomaly models so you don’t wait a day to spot big breakages. ### Hypothetical case study: Mid-market SaaS, 80 domains - **Situation**: Marketing platform changed IP pools; SPF includes were intact, but DKIM selectors expired. Alignment-fail rate spiked from 1.2% to 18% within 45 minutes on news.example.com. - **Response**: DMARCReport triggered a sustained-failure alert (>10% for 3 intervals of 15 minutes), paged marketing IT via PagerDuty, created a Jira task with vendor contact and DNS steps. A replacement selector was published within 28 minutes. - **Outcome**: Estimated 220K messages saved from quarantine/reject over 6 hours. Post-incident tuning reduced similar alert MTTR from 65 minutes median to 22 minutes. ## FAQs ### What’s the difference between DMARC “fail” and “misalignment,” and which should I alert on? - Fail means DMARC evaluation concluded the message did not pass policy (considering p/sp/pct); misalignment describes SPF/DKIM identity mismatch with the header-from domain. Alert on misalignment percentages early (p=none) to catch drift, and on DMARC fails when at p=quarantine/reject to protect delivery and brand. DMARCReport lets you run both channels **with different severities**. ### Do I need ruf (forensic) reports to get real-time alerts? - Not strictly. Many large providers limit ruf. You can still get timely alerts by combining rua trends, SMTP telemetry, and anomaly detection. When ruf is available, DMARCReport ingests it and elevates confidence; otherwise, it relies on enriched signals to approximate near real-time detection. ### How should I handle forwarding and mailing lists that break SPF? - Expect SPF to fail on forwarders; rely on DKIM alignment to carry authentication. Where DKIM is often stripped, [ARC (Authenticated Received Chain)](https://proton.me/blog/what-is-authenticated-received-chain-arc) can help. DMARCReport’s allowlists and ARC-aware heuristics prevent unnecessary alerts and provide tailored guidance for listservs and alumni forwarders. ![DMARC Monitoring: A Blueprint for Alignment and Alerting](https://media.mailhop.org/dmarcreport/how-to-create-dmarc-record-8963-1784543154799.jpg) ### Can I monitor third-party sender health separately? - Yes. Tag each vendor’s IPs/DKIM selectors and envelope domains. DMARCReport maintains a vendor directory and auto-tags traffic, enabling vendor-specific **SLAs and alerts routed** to the correct owners. ### How long should I retain DMARC data? - Keep detailed aggregates at least 13 months for seasonality; retain summarized rollups for 24–36 months as needed. DMARCReport supports tiered retention to balance cost and analytics depth. ## Conclusion: A practical blueprint with DMARCReport To reliably monitor and receive alerts when DMARC alignment breaks, enable rua/ruf in DNS, standardize policies across all domains and subdomains, and feed reports into a platform that parses, normalizes, and correlates them with smart alerting and [workflow automation](https://www.zoho.com/creator/what-is-workflow-automation.html). [DMARCReport](https://dmarcreport.com/) provides that end-to-end capability: hosted report endpoints, high-fidelity parsing, domain/subdomain/vendor-aware tagging, threshold and anomaly-based alerting, and native integrations with SIEMs, Slack/Teams, PagerDuty, and ticketing. Start with p=none and conservative thresholds, validate using Sandbox Mode and synthetic failures, then graduate to quarantine/reject with confidence—backed by DMARCReport’s dashboards, diagnostics, and scalable data pipeline that keep you **ahead of alignment breaks** and their business impact. ![Brad Slavin](https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg) [ Brad Slavin ](/authors/brad-slavin/) General Manager Founder and General Manager of DuoCircle. Product strategy and commercial lead for DMARC Report's 2,000+ customer base. [LinkedIn Profile →](https://www.linkedin.com/in/bradslavin) ## Take control of your DMARC reports Turn raw XML into actionable dashboards. Start free - no credit card required. [Start Free Trial](https://app.dmarcreport.com/signup?plan=free) [Check Your DMARC Record](/tools/dmarc-checker/) ## Related Articles [ Intermediate 4m 10 Reasons Why DKIM Fails Apr 19, 2022 ](/blog/10-reasons-why-dkim-fails/)[ Intermediate Accenture Sourcecode Breached, JADEPUFFER AI Ransomware, GodDamn Disables Windows Jul 14, 2026 ](/blog/accenture-sourcecode-breached-jadepuffer-ai-ransomware-goddamn-disables-windows/)[ Intermediate 8m Best DMARC Reporting Tools in 2026: Honest Comparison Mar 25, 2026 ](/blog/best-dmarc-reporting-tools-2026/)[ Intermediate 12m DMARC Passed. The Email Was Still an Attack. Inside the Blesta Ransom Incident Jun 28, 2026 ](/blog/blesta-ransom-email-dmarc-passed-authenticated-abuse/) ```json {"@context":"https://schema.org","@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com","logo":{"@type":"ImageObject","url":"https://dmarcreport.com/images/dmarcreport-logo.png"},"description":"DMARC reporting and email authentication management. Monitor aggregate and forensic DMARC reports, analyze authentication results, and enforce DMARC policies across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138898167","https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://www.g2.com/products/dmarc-report/reviews","https://github.com/duocircle","https://www.crunchbase.com/organization/duocircle-llc","https://www.trustradius.com/products/duocircle/reviews"],"aggregateRating":{"@type":"AggregateRating","ratingValue":"4.8","reviewCount":"471","bestRating":"5","worstRating":"1","url":"https://www.g2.com/products/dmarc-report/reviews"},"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://dmarcreport.com/support/"},"knowsAbout":["DMARC","DMARC Reporting","DMARC Aggregate Reports","DMARC Forensic Reports","Sender Policy Framework","DKIM","Email Authentication","Email Security","DNS Management","Email Deliverability"]} ``` ```json {"@context":"https://schema.org","@type":"WebSite","name":"DMARC Report","url":"https://dmarcreport.com","description":"DMARC reporting and email authentication management. Monitor aggregate and forensic DMARC reports, analyze authentication results, and enforce DMARC policies across all your domains.","publisher":{"@type":"Organization","name":"DMARC Report","url":"https://dmarcreport.com","logo":{"@type":"ImageObject","url":"https://dmarcreport.com/images/dmarcreport-logo.png"},"description":"DMARC reporting and email authentication management. Monitor aggregate and forensic DMARC reports, analyze authentication results, and enforce DMARC policies across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}}} ``` ```json [{"@context":"https://schema.org","@type":"BlogPosting","headline":"How Can I Monitor And Receive Alerts When DMARC Alignment Breaks For My Domains?","description":"Monitor DMARC alignment and receive instant alerts when authentication breaks, helping you quickly detect spoofing, misconfigurations, and deliverability risks.","url":"https://dmarcreport.com/blog/how-to-monitor-dmarc-alignment-breaks-and-receive-domain-alerts/","datePublished":"2026-07-20T00:00:00.000Z","dateModified":"2026-07-20T00:00:00.000Z","dateCreated":"2026-07-20T00:00:00.000Z","author":{"@type":"Person","@id":"https://dmarcreport.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://dmarcreport.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin is the founder and General Manager of DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. He founded DuoCircle in 2014 and has led the company's growth to 2,000+ customers across its email security product family. Brad's focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DMARC Report","url":"https://dmarcreport.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com","logo":{"@type":"ImageObject","url":"https://dmarcreport.com/images/dmarcreport-logo.png"},"description":"DMARC reporting and email authentication management. Monitor aggregate and forensic DMARC reports, analyze authentication results, and enforce DMARC policies across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138898167","https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://www.g2.com/products/dmarc-report/reviews","https://github.com/duocircle","https://www.crunchbase.com/organization/duocircle-llc","https://www.trustradius.com/products/duocircle/reviews"],"aggregateRating":{"@type":"AggregateRating","ratingValue":"4.8","reviewCount":"471","bestRating":"5","worstRating":"1","url":"https://www.g2.com/products/dmarc-report/reviews"},"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://dmarcreport.com/support/"},"knowsAbout":["DMARC","DMARC Reporting","DMARC Aggregate Reports","DMARC Forensic Reports","Sender Policy Framework","DKIM","Email Authentication","Email Security","DNS Management","Email Deliverability"]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://dmarcreport.com/blog/how-to-monitor-dmarc-alignment-breaks-and-receive-domain-alerts/"},"articleSection":"intermediate","keywords":"","image":{"@type":"ImageObject","url":"https://media.mailhop.org/dmarcreport/dmarc-check-4416-1784542769073.jpg","caption":"DMARC Alignment"},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}},{"@context":"https://schema.org","@type":"FAQPage","mainEntity":[{"@type":"Question","name":"What’s the difference between DMARC “fail” and “misalignment,” and which should I alert on?","acceptedAnswer":{"@type":"Answer","text":"- Fail means DMARC evaluation concluded the message did not pass policy (considering p/sp/pct); misalignment describes SPF/DKIM identity mismatch with the header-from domain. Alert on misalignment percentages early (p=none) to catch drift, and on DMARC fails when at p=quarantine/reject to protect..."}},{"@type":"Question","name":"Do I need ruf (forensic) reports to get real-time alerts?","acceptedAnswer":{"@type":"Answer","text":"- Not strictly. Many large providers limit ruf. You can still get timely alerts by combining rua trends, SMTP telemetry, and anomaly detection. When ruf is available, DMARCReport ingests it and elevates confidence; otherwise, it relies on enriched signals to approximate near real-time detection."}},{"@type":"Question","name":"How should I handle forwarding and mailing lists that break SPF?","acceptedAnswer":{"@type":"Answer","text":"- Expect SPF to fail on forwarders; rely on DKIM alignment to carry authentication. Where DKIM is often stripped, [ARC (Authenticated Received Chain)](https://proton.me/blog/what-is-authenticated-received-chain-arc) can help. DMARCReport’s allowlists and ARC-aware heuristics prevent unnecessary a..."}},{"@type":"Question","name":"Can I monitor third-party sender health separately?","acceptedAnswer":{"@type":"Answer","text":"- Yes. Tag each vendor’s IPs/DKIM selectors and envelope domains. DMARCReport maintains a vendor directory and auto-tags traffic, enabling vendor-specific **SLAs and alerts routed** to the correct owners."}},{"@type":"Question","name":"How long should I retain DMARC data?","acceptedAnswer":{"@type":"Answer","text":"- Keep detailed aggregates at least 13 months for seasonality; retain summarized rollups for 24–36 months as needed. DMARCReport supports tiered retention to balance cost and analytics depth."}}]}] ``` ```json {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://dmarcreport.com/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https://dmarcreport.com/blog/"},{"@type":"ListItem","position":3,"name":"Intermediate","item":"https://dmarcreport.com/intermediate/"},{"@type":"ListItem","position":4,"name":"How Can I Monitor And Receive Alerts When DMARC Alignment Breaks For My Domains?","item":"https://dmarcreport.com/blog/how-to-monitor-dmarc-alignment-breaks-and-receive-domain-alerts/"}]} ```