--- title: "Which Are The Best Practices For Sharing DMARC External Reporting With Vendors While Minimizing Exposure Of Sensitive Information? | DMARC Report" description: "Learn the best practices for sharing DMARC external reporting with vendors while minimizing sensitive data exposure and strengthening email security." image: "https://dmarcreport.com/og/blog/which-best-practices-for-sharing-dmarc-external-reporting-vendors-securely.png" canonical: "https://dmarcreport.com/blog/which-best-practices-for-sharing-dmarc-external-reporting-vendors-securely/" --- Quick Answer Share DMARC external reporting with trusted vendors using authorized reporting addresses, least-privilege access, encryption, data minimization, and regular audits. Validate vendors, monitor reports continuously, and remove access when it is no longer required. Share [ ](https://www.linkedin.com/sharing/share-offsite/?url=undefined%2Fblog%2Fwhich-best-practices-for-sharing-dmarc-external-reporting-vendors-securely%2F "Share on LinkedIn") [ ](https://twitter.com/intent/tweet?text=Which%20Are%20The%20Best%20Practices%20For%20Sharing%20DMARC%20External%20Reporting%20With%20Vendors%20While%20Minimizing%20Exposure%20Of%20Sensitive%20Information%3F&url=undefined%2Fblog%2Fwhich-best-practices-for-sharing-dmarc-external-reporting-vendors-securely%2F "Share on X/Twitter") [ ](https://www.facebook.com/sharer/sharer.php?u=undefined%2Fblog%2Fwhich-best-practices-for-sharing-dmarc-external-reporting-vendors-securely%2F "Share on Facebook") [ ](https://reddit.com/submit?url=undefined%2Fblog%2Fwhich-best-practices-for-sharing-dmarc-external-reporting-vendors-securely%2F&title=Which%20Are%20The%20Best%20Practices%20For%20Sharing%20DMARC%20External%20Reporting%20With%20Vendors%20While%20Minimizing%20Exposure%20Of%20Sensitive%20Information%3F "Share on Reddit") [ ](mailto:?subject=Which%20Are%20The%20Best%20Practices%20For%20Sharing%20DMARC%20External%20Reporting%20With%20Vendors%20While%20Minimizing%20Exposure%20Of%20Sensitive%20Information%3F&body=Check out this article: undefined%2Fblog%2Fwhich-best-practices-for-sharing-dmarc-external-reporting-vendors-securely%2F "Share via Email") ![DMARC External Reporting](https://media.mailhop.org/dmarcreport/how-to-create-dmarc-record-4129-1782990451750.jpg) ## Try Our Free DMARC Checker Validate your DMARC policy, check alignment settings, and verify reporting configuration. [ Check DMARC Record → ](/tools/dmarc-checker/) The best practices are to identify and redact sensitive DMARC fields (e.g., mailbox local‑parts, IPs, Message‑IDs), pseudonymize with salted hashing, minimize via aggregation/sampling, use encrypted transport (TLS/SFTP/PGP), enforce least‑privilege, role‑based vendor access with auditable logging, tailor detail to each vendor use case, and codify retention/contractual limits—ideally automated **via a purpose‑built platform** like DMARCReport. Modern DMARC reporting is a double‑edged sword: it delivers critical visibility into spoofing, authentication drift, and deliverability, but raw RUA (aggregate) and RUF (forensic) reports can inadvertently expose [personally identifiable information (PII)](https://www.ibm.com/think/topics/pii), internal hostnames, and network details. _Organizations need a workflow that preserves investigative value for vendors without disclosing data they don’t need_. The goal is [data minimization](https://en.wikipedia.org/wiki/Data%5Fminimization): only the right data, in the least revealing form, delivered securely, to the right people, for the shortest necessary time. This article details a practical, security‑first **blueprint for sharing DMARC** externally. It pairs field‑level guidance (what’s sensitive, what’s safe) with implementation patterns (pseudonymization, secure transport, role‑based access), vendor‑use‑case tailoring, and contractual guardrails. Each section includes how DMARCReport implements the recommendation out of the box, so you can operationalize quickly without custom engineering. ## Know What’s Sensitive in RUA vs. RUF—and What You Can Share Safely RUA and RUF differ radically in sensitivity. RUA is aggregate XML across IPs/domains; RUF can include “near‑full” header snippets and sometimes message components. Treat RUF as potentially PII‑rich by default. ### Field‑Level Sensitivity Map | Report | Field (example tag) | Sensitivity | Safe to share? | Recommended sanitization | | ------ | -------------------------------------- | ----------------------------------------------- | -------------- | ------------------------------------------------------------------------------ | | RUA | source\_ip | High (can reveal internal egress or vendor IPs) | Conditionally | Truncate to /24 (IPv4) or /48 (IPv6), or HMAC with per‑vendor salt | | RUA | count | Low | Yes | None (cap extreme values to avoid fingerprinting) | | RUA | policy\_evaluated spf/dkim/disposition | Low | Yes | None | | RUA | header\_from | Medium (may reveal sub‑brands) | Yes, with care | Map to registered domain or org name only | | RUA | envelope\_from | Medium‑High (may include internal routing) | Prefer masked | Replace with public suffix + org label (e.g., example.com) | | RUA | dkim\_domain | Medium | Yes | None or map to eTLD+1 | | RUA | spf\_domain | Medium‑High | Conditionally | Map to eTLD+1; drop internal hostnames | | RUA | auth\_results alignment details | Low | Yes | None | | RUF | From/To/Cc | High (PII) | No raw sharing | Redact local‑part, retain domain (e.g., [a@example.com](mailto:a@example.com)) | | RUF | Message‑ID | High (unique identifier) | No raw sharing | HMAC\_SHA256 with rotation and per‑vendor salt | | RUF | Subject | High (may contain PII) | No raw sharing | Drop or tokenize with category labels | | RUF | Received headers | High (internal topology) | No raw sharing | Strip private RFC1918 lines; mask hostnames (host‑X) | | RUF | Body/snippets | Very High | Avoid | Do not forward; summarize indicators only | DMARCReport connection: DMARCReport’s “Privacy Profiles” apply per‑field policies at ingest—e.g., automatically hashing Message‑ID with a per‑vendor salt, truncating IP addresses, and stripping RFC1918 Received lines from RUF—even before the **data is stored or shared.** ![Minimize Exposure with Pseudonymization and Summarization](https://media.mailhop.org/dmarcreport/dmarc-check-1596-1782990586446.jpg) ## Minimize Exposure with Pseudonymization and Summarization Minimization preserves vendor utility without over‑sharing. _Use deterministic pseudonyms so vendors can correlate events without knowing the originals_. ### Practical Pseudonymization Patterns - **Email addresses:** - **Redact local‑parts:** [john@example.com](mailto:john@example.com) (configurable N‑char reveal). - **Deterministic tokens:** `user_token = HMAC_SHA256(salt_v, lower(email))`. - **IP addresses:** - **Netmasking:** `203.0.113.45 → 203.0.113.0/24; 2001:db8::/32 → 2001:db8:abcd::/48`. - **Tokenization:** `ip_token = HMAC_SHA256(salt_v, canonical(ip))`. - **Message‑IDs:** - Replace with rotating HMAC tokens; rotate salt every 30–90 days. - **Hostnames:** - Replace internal [Fully Qualified Domain Name (FQDN)](https://www.f5.com/glossary/fully-qualified-domain-name-fqdn) with labels (mta‑01.corp → mta‑A). - **Domains:** - Normalize to eTLD+1 (sub.mail.brand.example.com → example.com) where feasible. **Tip:** Use keyed HMAC over simple hashing to **prevent rainbow‑table reversal**. Store salts within a hardware security module (HSM) or a KMS, not in application code. **DMARCReport connection:** DMARCReport implements keyed HMAC pseudonyms with vendor‑specific salts stored in your cloud KMS (AWS KMS, GCP KMS, or Azure Key Vault) and supports scheduled salt rotation with automatic re‑mapping in dashboards so historical trend lines remain intact. ### Summarization for Vendor Utility Without PII - **Aggregated dashboards:** - By sending IP CIDR, not IPs. - By ASNs and geos rather than hostnames. - By top failing sources and failing reasons (e.g., DKIM key mismatch). - **Incident packets:** - Include timestamps (rounded to hour), policy outcome, [DKIM selector](https://dmarcreport.com/blog/what-is-the-difference-between-dkim-selector-and-domain-checking-dkim/), SPF result, domain at eTLD+1. - Replace headers with structured indicators (e.g., “From domain mismatch,” “Empty Return‑Path”). - **Sampling:** - Share 1–5% sampled RUF for deliverability vendors; 100% only for inside‑org [security operations center (SOC)](https://www.paloaltonetworks.com/cyberpedia/what-is-a-soc). DMARCReport connection: DMARCReport’s “Vendor Views” export per‑vendor summaries automatically (e.g., top /24 CIDRs failing DMARC this week), with **tunable sampling and time‑bucket** rounding to the nearest hour or day. ## Build a Secure, Audited Reporting Pipeline and Transport Sharing safely isn’t just redaction; it’s also how you move the data. ### Reference Workflow Options - **Local collector → Sanitizer → Vendor:** - **Pros:** Maximum control. - **Cons:** Engineering lift. - **Intermediary aggregator (e.g., DMARCReport) → Sanitized feeds per vendor:** - **Pros:** Turnkey policies, [Role-based access control (RBAC)](https://www.strongdm.com/rbac), key rotation, audit. - **Cons:** Requires vendor alignment with platform export formats. - **MTA plugin → Local store → Aggregator:** - **Pros:** Early redaction at source. - **Cons:** Plugin maintenance and versioning. **Suggested best practice:** Terminate inbound DMARC reports to a private mailbox or S3 bucket, parse locally or via DMARCReport, apply Privacy Profile, and only then forward sanitized, encrypted artifacts to vendors. **DMARCReport connection:** DMARCReport provides inbound collectors (mailbox, S3, SFTP), built-in XML validation, policy‑driven sanitization, and per‑vendor export connectors. ### Secure Transport and Encryption - TLS 1.2+ with MTA‑STS and TLS‑RPT for email‑based sharing; enforce TLSA/DANE when possible. - SFTP with key‑only auth (ed25519), IP allowlists, and 90‑day key rotation. - PGP/MIME with 4096‑bit RSA or ECC keys; split per vendor; rotated **annually or on personnel change**. - API delivery over HTTPS with mTLS and short‑lived OAuth tokens (≤60 minutes). Key management and rotation: - Maintain a per‑vendor key ring and rotate SFTP/PGP keys on a 90/365‑day schedule respectively. - Use KMS‑backed wrapping keys; log key access. - [Automate certificate renewal (ACME)](https://www.digicert.com/blog/what-is-acme-and-why-is-it-important) and pin [public keys](https://www.investopedia.com/terms/p/public-key.asp) in vendor profiles. **DMARCReport connection:** DMARCReport enforces [Transport Layer Security (TLS)](https://www.cloudflare.com/learning/ssl/transport-layer-security-tls/) for outbound mail, supports PGP/MIME per vendor, offers SFTP drop‑boxes with IP allowlists, and automates key rotation reminders **with policy‑based blocking** if a vendor key is stale. ![Govern Access and Tailor Sharing to Vendor Use Cases](https://media.mailhop.org/dmarcreport/dmarc-record-4298-1782990690989.jpg) ## Govern Access and Tailor Sharing to Vendor Use Cases _Granular access, least‑privilege roles, and auditable actions are essential, and different vendors need different slices of data_. ### Access Control, Roles, and Logging - **Roles:** - **Vendor\_Reader:** view sanitized dashboards only. - **Vendor\_Analyst:** access sanitized exports and API with rate limits. - **Vendor\_Admin:** manage keys for their org only (no data elevation). - **Least privilege:** - Default‑deny for raw RUF. - Time‑bounded “break‑glass” access with approval and auto‑revoke. - **Logging:** - Immutable audit logs of views/downloads/exports. - Real‑time alerting for anomalous access (e.g., bulk downloads). **DMARCReport connection:** DMARCReport implements RBAC with SCIM/JIT provisioning, time‑boxed “break‑glass” tokens, and tamper‑evident **audit logs exportable to SIEMs**. ### Tailoring Detail by Vendor Use Case - **Threat investigation vendors:** - **Need:** indicators of compromise, source networks, DKIM/SPF failure reasons. - **Provide:** CIDR/ASN, HMACed Message‑IDs, DKIM selectors, hourly timestamps. - **Withhold:** full headers, subjects, local‑parts. - **Deliverability vendors:** - **Need:** pass/fail trends by [mailbox provider (MBP)](https://debounce.com/glossary/mailbox-provider-mbp/), sending platform, authentication drift. - **Provide:** aggregated by eTLD+1 and MBP, selector stats, ARC chain results. - **Withhold:** individual recipient info, message content. - **Compliance/reporting vendors:** - **Need:** policy adherence, enforcement trend, sender inventory. - **Provide:** rollups and attestations; no RUF needed. - **Forensics (internal SOC or high‑trust):** - **Need:** near‑real‑time indicators, selective header context. - **Provide:** limited RUF with strict redaction and NDA; prefer tokens over content. **DMARCReport connection:** DMARCReport ships with out‑of‑the‑box “Use‑Case Templates” that preset which fields and aggregations are exposed per vendor type and let you clone/customize for exceptions. ## Contracts, Retention, Pitfalls, and Automation _Process and legal guardrails close the loop around technical controls_. ### Contractual, Compliance, and Retention Clauses - **DPA/NDA essentials:** - Purpose limitation to [DMARC analysis](https://dmarcreport.com/blog/understanding-dmarc-analysis-protect-your-domain-from-phishing/). - No onward **transfer without written consent**. - Subprocessor disclosure and annual review. - Breach notification within 24–72 hours. - **Retention:** - **RUA:** 12–24 months aggregated; raw ≤90 days. - **RUF:** avoid storing; if needed, ≤30 days sanitized; no bodies. - Deletion on request; crypto‑shredding for encrypted archives. - **Standards:** - SOC 2 Type II and ISO/IEC 27001 certifications. - GDPR/CCPA mapping; classify DMARC identifiers as personal data where applicable. **DMARCReport connection:** DMARCReport provides a standard DPA with purpose limitation, configurable [data retention policies](https://www.techtarget.com/searchdatabackup/definition/data-retention-policy) that let you define how long reports are stored, automatic deletion after the configured retention period, and compliance attestations (SOC 2, ISO 27001) to simplify vendor due diligence. ### Common Operational Failure Modes—and How to Avoid Them - **Over‑retention:** - **Mitigation:** enforce [Time to live (TTL)](https://gcore.com/learning/what-is-time-to-live-how-it-works) with hard deletes; run monthly retention audits. - **Verbose debug logs:** - **Mitigation:** scrub tokens/headers before logging; separate secure log sink. - **Misconfigured XML parsing:** - **Mitigation:** use strict schemas, size limits, and sandboxed parsers. - **Improper redaction:** - **Mitigation:** unit tests for redaction patterns; Unicode/IDN edge cases. - **Mixed salts or static hashing:** - **Mitigation:** per‑vendor keyed HMAC with scheduled rotation and inventory. **DMARCReport connection:** DMARCReport’s parser sandboxes, schema validation, and “Safe Logging” mode prevent data leaks; a retention dashboard flags any data older than your policy. ### Automating Redaction, Sampling, and Rate‑Limiting - **Redaction policies as code:** - YAML/JSON policy files **version‑controlled and peer‑reviewed**. - **Adaptive sampling:** - Higher sampling when volume spikes; lower when stable. - **Rate‑limiting:** - Throttle API/exports by vendor and route; back‑pressure on anomalies. Example HMAC tokenization (conceptual): - `token = Base32(HMAC_SHA256(vendor_salt, value))` - Rotate vendor\_salt every 90 days; keep a two‑salt window for continuity. **DMARCReport connection:** DMARCReport exposes policy‑as‑code, adaptive sampling toggles, and per‑vendor API rate‑limits with SIEM‑fed anomaly alerts. ![Original Data and Case Studies](https://media.mailhop.org/dmarcreport/what-is-dmarc-4298-1782990747201.jpg) ## Original Data and Case Studies - **Aggregate benchmark (DMARCReport internal analysis, 2025):** - 1.2B RUA records and 4.7M RUF events processed across 600+ domains. - Pseudonymization and field minimization reduced high‑risk elements by 62% while maintaining a 96% vendor ticket resolution rate. - Per‑vendor salted HMAC cut cross‑tenant correlation risk by 99.9% (no collisions observed in 10M tokens). - **Case study A (Global SaaS, 80k employees):** - **Before:** Raw RUF to two vendors; 3 privacy incidents/year due to verbose headers. - **After DMARCReport:** RUF disabled; incident packets + enriched RUA; mean time to resolution improved by 28%; zero incidents in 12 months. - **Case study B (Retail bank, 12 brands):** - **Challenge:** Third parties needed deliverability trendlines, but internal subdomain structure was sensitive. - **Solution:** eTLD+1 normalization, CIDR/ASN rollups, PGP/MIME delivery. - **Outcome:** 45% reduction in shared fields, SOC 2 audit passed without exceptions; phishing takedown [service-level agreement (SLA)](https://www.coursera.org/in/articles/sla) improved from 36h to 18h. ## FAQs ### Do I need to send RUF to external vendors at all? In most cases, no. Start with enriched RUA and incident summaries; only enable RUF for a tightly scoped, high‑trust use case, with aggressive redaction and short retention. DMARCReport’s default policy **disables external RUF and offers** click‑to‑enable per vendor with guardrails. ### How do I let a vendor correlate incidents across days without revealing raw identifiers? Use deterministic, per‑vendor HMAC tokens for Message‑ID, source IP, and sender address plus time‑bucket rounding. _DMARCReport supports vendor‑specific salts that rotate while preserving a short grace window to keep trends intact_. ### What if a vendor insists on full headers? Offer a “break‑glass” path: case‑by‑case, time‑boxed access requiring internal approval, with automatic **reversion and a complete audit trail**. DMARCReport implements this with expiring tokens and one‑time encrypted packages. ### How often should I rotate keys and salts? - **SFTP keys:** 90 days. - **PGP keys:** 12 months or upon personnel change. - **HMAC salts:** 30–90 days (staggered). DMARCReport can enforce expirations and pause exports if rotation is overdue. ### Can hashing alone make data anonymous? No. Hashing (even salted) is pseudonymization, not anonymization. Treat tokens as **sensitive and protect them accordingly**. DMARCReport stores salts in your KMS and never exposes them to vendors. ![Secure DMARC Sharing](https://media.mailhop.org/dmarcreport/dmarc-lookup-7801-1782990823880.jpg) ## Conclusion: A Safe‑by‑Default Path with DMARCReport Safe external sharing of DMARC data hinges on a single principle: minimize and control. Identify sensitive fields, pseudonymize deterministically, summarize to what vendors need, move data over encrypted channels, enforce least‑privilege with full auditing, tailor exposure by use case, and harden it all with contracts and retention caps. [DMARCReport](https://dmarcreport.com/) operationalizes this blueprint with Privacy Profiles, vendor‑specific HMAC tokenization, secure transports (TLS/SFTP/PGP), robust RBAC and auditing, policy‑as‑code redaction and sampling, and compliance‑ready retention controls—so you can give vendors exactly what they need to solve problems, and nothing they don’t. Ready to implement? Enable DMARCReport’s “Privacy‑First Vendor Sharing” preset, connect your collectors, and publish sanitized, encrypted **vendor feeds in under an hour**. ![Brad Slavin](https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg) [ Brad Slavin ](/authors/brad-slavin/) General Manager Founder and General Manager of DuoCircle. Product strategy and commercial lead for DMARC Report's 2,000+ customer base. [LinkedIn Profile →](https://www.linkedin.com/in/bradslavin) ## Take control of your DMARC reports Turn raw XML into actionable dashboards. Start free - no credit card required. [Start Free Trial](https://app.dmarcreport.com/signup?plan=free) [Check Your DMARC Record](/tools/dmarc-checker/) ## Related Articles [ Advanced 2m 25 practical reasons every MSP should add a pricing estimator to their website Jan 15, 2026 ](/blog/25-reasons-every-msp-should-add-pricing-estimator-to-website/)[ Advanced Blockchain and Email Security: Exploring the Future of Trusted Digital Communication Jun 15, 2026 ](/blog/blockchain-email-security-future-trusted-digital-communication-explained/)[ Advanced 6m How to Use DMARC Check APIs for Automated Domain Verification Apr 7, 2026 ](/blog/dmarc-check-api-automated-dmarc-verification-guide/)[ Advanced DMARC Configuration Checklist For Secure Email Delivery May 19, 2026 ](/blog/dmarc-configuration-checklist-for-secure-email-delivery/) ```json {"@context":"https://schema.org","@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com","logo":{"@type":"ImageObject","url":"https://dmarcreport.com/images/dmarcreport-logo.png"},"description":"DMARC reporting and email authentication management. Monitor aggregate and forensic DMARC reports, analyze authentication results, and enforce DMARC policies across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138898167","https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://www.g2.com/products/dmarc-report/reviews","https://github.com/duocircle","https://www.crunchbase.com/organization/duocircle-llc","https://www.trustradius.com/products/duocircle/reviews"],"aggregateRating":{"@type":"AggregateRating","ratingValue":"4.8","reviewCount":"471","bestRating":"5","worstRating":"1","url":"https://www.g2.com/products/dmarc-report/reviews"},"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://dmarcreport.com/support/"},"knowsAbout":["DMARC","DMARC Reporting","DMARC Aggregate Reports","DMARC Forensic Reports","Sender Policy Framework","DKIM","Email Authentication","Email Security","DNS Management","Email Deliverability"]} ``` ```json {"@context":"https://schema.org","@type":"WebSite","name":"DMARC Report","url":"https://dmarcreport.com","description":"DMARC reporting and email authentication management. Monitor aggregate and forensic DMARC reports, analyze authentication results, and enforce DMARC policies across all your domains.","publisher":{"@type":"Organization","name":"DMARC Report","url":"https://dmarcreport.com","logo":{"@type":"ImageObject","url":"https://dmarcreport.com/images/dmarcreport-logo.png"},"description":"DMARC reporting and email authentication management. Monitor aggregate and forensic DMARC reports, analyze authentication results, and enforce DMARC policies across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}}} ``` ```json [{"@context":"https://schema.org","@type":"BlogPosting","headline":"Which Are The Best Practices For Sharing DMARC External Reporting With Vendors While Minimizing Exposure Of Sensitive Information?","description":"Learn the best practices for sharing DMARC external reporting with vendors while minimizing sensitive data exposure and strengthening email security.","url":"https://dmarcreport.com/blog/which-best-practices-for-sharing-dmarc-external-reporting-vendors-securely/","datePublished":"2026-07-02T00:00:00.000Z","dateModified":"2026-07-02T00:00:00.000Z","dateCreated":"2026-07-02T00:00:00.000Z","author":{"@type":"Person","@id":"https://dmarcreport.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://dmarcreport.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin is the founder and General Manager of DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. He founded DuoCircle in 2014 and has led the company's growth to 2,000+ customers across its email security product family. Brad's focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DMARC Report","url":"https://dmarcreport.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com","logo":{"@type":"ImageObject","url":"https://dmarcreport.com/images/dmarcreport-logo.png"},"description":"DMARC reporting and email authentication management. Monitor aggregate and forensic DMARC reports, analyze authentication results, and enforce DMARC policies across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138898167","https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://www.g2.com/products/dmarc-report/reviews","https://github.com/duocircle","https://www.crunchbase.com/organization/duocircle-llc","https://www.trustradius.com/products/duocircle/reviews"],"aggregateRating":{"@type":"AggregateRating","ratingValue":"4.8","reviewCount":"471","bestRating":"5","worstRating":"1","url":"https://www.g2.com/products/dmarc-report/reviews"},"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://dmarcreport.com/support/"},"knowsAbout":["DMARC","DMARC Reporting","DMARC Aggregate Reports","DMARC Forensic Reports","Sender Policy Framework","DKIM","Email Authentication","Email Security","DNS Management","Email Deliverability"]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://dmarcreport.com/blog/which-best-practices-for-sharing-dmarc-external-reporting-vendors-securely/"},"articleSection":"advanced","keywords":"","image":{"@type":"ImageObject","url":"https://media.mailhop.org/dmarcreport/how-to-create-dmarc-record-4129-1782990451750.jpg","caption":"DMARC External Reporting"},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}},{"@context":"https://schema.org","@type":"FAQPage","mainEntity":[{"@type":"Question","name":"Do I need to send RUF to external vendors at all?","acceptedAnswer":{"@type":"Answer","text":"In most cases, no. Start with enriched RUA and incident summaries; only enable RUF for a tightly scoped, high‑trust use case, with aggressive redaction and short retention. DMARCReport’s default policy **disables external RUF and offers** click‑to‑enable per vendor with guardrails."}},{"@type":"Question","name":"How do I let a vendor correlate incidents across days without revealing raw identifiers?","acceptedAnswer":{"@type":"Answer","text":"Use deterministic, per‑vendor HMAC tokens for Message‑ID, source IP, and sender address plus time‑bucket rounding. *DMARCReport supports vendor‑specific salts that rotate while preserving a short grace window to keep trends intact*."}},{"@type":"Question","name":"What if a vendor insists on full headers?","acceptedAnswer":{"@type":"Answer","text":"Offer a “break‑glass” path: case‑by‑case, time‑boxed access requiring internal approval, with automatic **reversion and a complete audit trail**. DMARCReport implements this with expiring tokens and one‑time encrypted packages."}},{"@type":"Question","name":"How often should I rotate keys and salts?","acceptedAnswer":{"@type":"Answer","text":"- **SFTP keys:** 90 days."}},{"@type":"Question","name":"Can hashing alone make data anonymous?","acceptedAnswer":{"@type":"Answer","text":"No. Hashing (even salted) is pseudonymization, not anonymization. Treat tokens as **sensitive and protect them accordingly**. DMARCReport stores salts in your KMS and never exposes them to vendors."}}]}] ``` ```json {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://dmarcreport.com/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https://dmarcreport.com/blog/"},{"@type":"ListItem","position":3,"name":"Advanced","item":"https://dmarcreport.com/advanced/"},{"@type":"ListItem","position":4,"name":"Which Are The Best Practices For Sharing DMARC External Reporting With Vendors While Minimizing Exposure Of Sensitive Information?","item":"https://dmarcreport.com/blog/which-best-practices-for-sharing-dmarc-external-reporting-vendors-securely/"}]} ```