Why do DMARC reports have a limit of 32KB?

DMARC reporting without automation is like watching security cameras without recording, says Brad Slavin, General Manager of DuoCircle. You see the threats in real time but you can’t go back and investigate. DMARC Report captures and classifies every aggregate and forensic report so your security team has a complete audit trail.

DMARC (RFC 7489) ties SPF and DKIM together by requiring alignment between the envelope sender and the visible From header. According to Google’s February 2024 bulk sender requirements, a DMARC policy of at least p=none is now mandatory for any domain sending 5,000+ messages per day to Gmail users. DMARC Report

Why do DMARC reports have a limit of 32KB?

					<button title="Play" aria-label="Play Episode" aria-pressed="false" class="play-btn">
						

Play Episode

					</button>
					<button title="Pause" aria-label="Pause Episode" aria-pressed="false" class="pause-btn hide">
						

Pause Episode

					</button>
					


				

				

					<audio preload="none" class="clip clip-30120">
						<source src="https://media.mailhop.org/dmarcreport/images/2025/07/Why-do-DMARC-reports-have-a-limit-of-32KB.mp3">
					</audio>
					

						

					

					

						

							<button class="player-btn player-btn__volume" title="Mute/Unmute">
								

Mute/Unmute Episode

							</button>
							<button data-skip="-10" class="player-btn player-btn__rwd" title="Rewind 10 seconds">
								

Rewind 10 Seconds

							</button>
							<button data-speed="1" class="player-btn player-btn__speed" title="Playback Speed" aria-label="Playback Speed">1x</button>
							<button data-skip="30" class="player-btn player-btn__fwd" title="Fast Forward 30 seconds">
								

Fast Forward 30 seconds

							</button>
						

						

							<time class="ssp-timer">00:00</time>
							

/

							<!-- We need actual duration here from the server -->
							<time class="ssp-duration" datetime="PT0H1M58S">1:58</time>
						

					

				

			

								<nav class="player-panels-nav">
												<button class="subscribe-btn" id="subscribe-btn-30120" title="Subscribe">Subscribe</button>
																		<button class="share-btn" id="share-btn-30120" title="Share">Share</button>
										</nav>
						

	



		

						

				

					

					

				

				

					

																																																																								

					

						

RSS Feed

							<input value="https://dmarcreport.com/feed/podcast/dmarc-report" class="input-rss input-rss-30120" title="RSS Feed URL" readonly />
						

						<button class="copy-rss copy-rss-30120" title="Copy RSS Feed URL" aria-label="Copy RSS Feed URL"></button>
					

				

			

									

				

					

					

				

				

					

						Share						

					

						<a href="https://www.facebook.com/sharer/sharer.php?u=https://dmarcreport.com/blog/podcast/why-do-dmarc-reports-have-a-limit-of-32kb/&t=Why do DMARC reports have a limit of 32KB?" target="blank" rel="noopener noreferrer" class="share-icon facebook" title="Share on Facebook">
							

						</a>
						<a href="https://twitter.com/intent/tweet?text=https://dmarcreport.com/blog/podcast/why-do-dmarc-reports-have-a-limit-of-32kb/&url=Why do DMARC reports have a limit of 32KB?" target="blank" rel="noopener noreferrer" class="share-icon twitter" title="Share on Twitter">
							

						</a>
						<a href="https://media.mailhop.org/dmarcreport/images/2025/07/Why-do-DMARC-reports-have-a-limit-of-32KB.mp3" target="blank" rel="noopener noreferrer" class="share-icon download" title="Download" download>
							

						</a>
					

				

				

					

						Link						

					

						<input value="https://dmarcreport.com/blog/podcast/why-do-dmarc-reports-have-a-limit-of-32kb/" class="input-link input-link-30120" title="Episode URL" readonly />
					

					<button class="copy-link copy-link-30120" title="Copy Episode URL" aria-label="Copy Episode URL" readonly=""></button>
				

				

					

						Embed						

					

/*! This file is auto-generated */ ’ title=“Embed Code” class=“input-embed input-embed-30120” readonly/>

					<button class="copy-embed copy-embed-30120" title="Copy Embed Code" aria-label="Copy Embed Code"></button>
				

			

				

There are various rules around DMARC, most of which are defined by DMARC RFC 7489, but there’s one that is not imposed by the protocol. It’s the 32KB report size limit. This limit is enforced not by DMARC itself but by mail providers, due to certain operational constraints.

Major email service providers (ESPs) like Gmail and Yahoo have set a limit of 32KB on DMARC aggregate reports (RUA), so anything larger than that is either cut off, partially delivered, or sometimes not sent at all.

This becomes a major problem if you send a large volume of emails every day - say, around 100,000 emails. In such cases, you might end up receiving the DMARC report for only half of them. The rest either get dropped or never make it to your reporting address, leaving you with an incomplete view of your domain’s authentication activity.

In this article, we will explore what the 32KB threshold is all about and why ESPs even impose this limit.

Why do ESPs need a 32KB limit?

DMARC XML reports are very well-rounded and capture almost everything about your domain’s email activity, from the IP addresses sending email on your behalf to DKIM signatures, SPF results, subdomain usage, and policy dispositions. So, naturally, these reports get very heavy. And if you’re using multiple platforms or third-party services to send emails, the report becomes even heavier. This makes it very difficult for the receiving mailbox providers to process and transfer these reports efficiently. So, to avoid any delays or failures in delivery, these ESPs enforce a 32KB limit.

What happens when you exceed this limit?

Most often, mail providers cannot handle large DMARC reports as attachments once they cross the 32KB threshold. When that happens, you encounter one of three things:

• Your reports are truncated, which means they are cut off halfway, and you only receive a **partial report that fits the 32KB limit. Everything beyond that gets silently dropped, leaving you with an incomplete view of your domain’s email activity .

• Your DMARC reports aren’t sent at all. Some mailbox providers simply discard oversized reports without any warning or error message.

• Your reports are split into multiple smaller reports, each under the size limit. Although this may not seem like a problem, its inconsistent implementation across providers can make it challenging to track and stitch together. In all three cases, you lose critical visibility, and that can mean missing signs of spoofing, misconfigurations, or giving way to unauthorized activity.

What can you do to stay within the limit?

**Staying within the 32KB limit can be tricky, especially because most mailbox providers don’t tell you when you’ve crossed it. You might assume your reports are complete when in reality, a chunk of them may be missing. So, it’s best that you stay on top of things right off the bat.

Here’s how you can stay within the limit:

• Minimize the number of sending sources

• Avoid unnecessary subdomain reporting

• Delegate subdomains with separate DMARC records

• Regularly audit third-party senders

• Use DMARC analytics tools to detect gaps in your DMARC reports

Need help managing and monitoring your DMARC reports? **Our team is here to assist! Contact us today to learn more.