Aggregate reports turn raw XML into
email authentication intelligence
DMARC aggregate reports (RUA) are daily XML summaries sent by receiving mail servers that show every IP address sending email from your domain, the volume of messages, and whether SPF, DKIM, and DMARC passed or failed for each source.
What is a DMARC
aggregate report?
An aggregate report is an XML file sent by email receivers - Google, Microsoft, Yahoo, and thousands of others - summarizing how email from your domain performed against SPF, DKIM, and DMARC checks over a reporting period (typically 24 hours).
Reports are triggered by the rua= tag in your DMARC record. Without it, you receive no reports and have zero visibility into who is sending email as your domain.
According to a 2024 DMARC.org survey, over 5.8 million domains publish DMARC records - but many still lack a rua= tag, leaving them blind to abuse.
From raw XML to visual dashboard
Raw aggregate reports are XML files that can be thousands of lines long. A single domain receiving reports from Gmail, Outlook, Yahoo, and dozens of other receivers accumulates hundreds of files per day. Manually parsing them is not viable.
<?xml version="1.0"?> <feedback> <report_metadata> <org_name>google.com</org_name> <report_id>17438926547812</report_id> <date_range> <begin>1712188800</begin> <end>1712275199</end> </date_range> </report_metadata> <policy_published> <domain>example.com</domain> <p>none</p> <adkim>r</adkim> <aspf>r</aspf> </policy_published> <record> <row> <source_ip>142.250.115.26</source_ip> <count>14832</count> <policy_evaluated> <disposition>none</disposition> <dkim>pass</dkim> <spf>pass</spf> </policy_evaluated> </row> </record> </feedback>
What's inside an aggregate report
Every aggregate report follows the same XML structure defined by RFC 7489. Three main sections tell you who reported, what policy they saw, and what happened to your email.
<report_metadata> Identifies who sent the report (Google, Microsoft, Yahoo, etc.), the report ID, and the date range covered - typically a 24-hour window.
<policy_published> Shows the DMARC policy the receiver saw in your DNS at the time of evaluation - your domain, policy level, subdomain policy, and alignment modes.
<record > row> One row per sending source. Contains the IP address, message count, what the receiver did with the messages, and individual SPF/DKIM/DMARC results.
How to read aggregate reports
Whether you use a tool like DMARC Report or read XML manually, follow these four steps to extract actionable intelligence from every report.
Identify the reporter
Check <org_name> to see which receiver sent the report - Google, Microsoft, Yahoo, or others. This tells you where your email was delivered.
Check your policy
Review <policy_published> to confirm receivers see the correct DMARC policy, alignment modes, and percentage. Mismatches indicate DNS propagation issues.
Review each source
Examine each <record> row - the source IP, message count, and authentication results. Classify sources as legitimate senders or potential threats.
Investigate failures
For any source showing SPF or DKIM failures, determine if it is an authorized sender with a misconfiguration or an unauthorized sender spoofing your domain.
Common aggregate report issues
Not receiving reports
Missing or malformed rua= tag in your DMARC record. The rua= address must be a mailto: URI.
Use our DMARC Checker to verify your record is published correctly.
Too many reports to read
Active domains receive hundreds of XML files daily from receivers worldwide. Manual analysis does not scale.
DMARC Report ingests, parses, and classifies reports automatically - identifying 200+ email vendors.
External domain authorization
Sending reports to a mailbox on a different domain requires the receiving domain to authorize it via DNS.
Publish a TXT record at yourdomain._report._dmarc.receiverdomain with value v=DMARC1.
Frequently asked questions
How often are DMARC aggregate reports sent?
Most receivers send aggregate reports once per day, covering a 24-hour reporting period. Large receivers like Google, Microsoft, and Yahoo typically deliver reports between 00:00 and 06:00 UTC. Some smaller receivers batch reports weekly.
Why am I not receiving DMARC aggregate reports?
The most common cause is a missing or malformed rua= tag in your DMARC record. Use our free DMARC Checker to verify. If you are sending reports to an address on a different domain, you need a _report._dmarc authorization record on the receiving domain.
Can I send DMARC reports to a domain I don't own?
Yes, but the receiving domain must authorize it. Publish a DNS TXT record at yourdomain._report._dmarc.receiverdomain with the value v=DMARC1. This prevents unauthorized mailbox flooding.
How long does it take to reach DMARC enforcement?
Moving from p=none to p=reject typically takes 9 to 18 months, with a minimum of 90 days at each policy phase. Aggregate reports are essential throughout this process - they are the only way to identify all legitimate senders before tightening your policy.
What is the difference between RUA and RUF reports?
RUA (aggregate) reports are daily XML summaries showing volume and authentication results for every sending source. RUF (forensic) reports provide per-message failure details including email headers and subject lines. Learn more on our forensic report page.
Stop reading raw XML
DMARC Report processes your aggregate reports automatically - classifying senders, tracking trends, and alerting you when authentication changes.
Start Free TrialWhat Users Say About Our Report Analysis
Rated 4.8/5 on G2 · 469 verified reviews
Dave G.
Owner
"DMARC Report has been invaluable in fixing email deliverability issues for our clients"
DMARC Report dashboard allows us to see easily what is compliant and what isn't compliant so we can quickly fix issues.
Zunaid K.
Director
"Essential tool for email delivery"
This tool helps us to implement DMARC reporting for our domains in an easy to use manner.
Verified User in Information Technology and Services
"Best security tool for your own domains"
The weekly reports help me a lot to analyze quickly the emails sent from my domains and that gives me peace of mind.