--- title: "DMARC Reporting - Aggregate & Forensic Report Analysis | DMARC Report" description: "Turn raw DMARC XML into actionable intelligence. Analyze aggregate (RUA) and forensic (RUF) reports, identify unauthorized senders, check alignment, and move toward DMARC enforcement with DMARC Report." image: "https://dmarcreport.com/images/og-default.png" canonical: "https://dmarcreport.com/dmarc-report/" --- DMARC Reporting # Turn raw XML into actionable intelligence DMARC aggregate and forensic reports decoded, visualized, and prioritized so you know exactly who is sending email as your domain and what to do about it. [ Start Free Trial → ](https://app.dmarcreport.com/) [View Pricing](/pricing/) The Basics ## Two report types, one complete picture DMARC generates two kinds of reports. Aggregate reports (RUA) give you daily summaries of all email activity across your domain. Forensic reports (RUF) give you per-message failure details when something goes wrong. RUA (Aggregate) Daily XML summaries from receivers showing every source IP, authentication results, and disposition. The foundation of DMARC visibility. RUF (Forensic) Per-message failure reports with full headers, sender IP, and the exact reason authentication failed. Critical for investigating spoofing attempts. Raw XML google 1714521600 142.250... 847 pass pass Dashboard 94.2% Pass Rate G Google Pass ? Unknown Fail Aggregate Report - example.com 94.2% DMARC Pass 12 Senders 3 Warnings G Google Workspace 142.250.x.x · 2,847 msgs SPF pass DKIM pass M Microsoft 365 40.107.x.x · 1,203 msgs SPF pass DKIM pass S SendGrid 168.245.x.x · 456 msgs SPF pass DKIM pass M Mailchimp 205.201.x.x · 89 msgs SPF pass DKIM fail ? Unknown sender 91.203.x.x · 14 msgs SPF fail DKIM fail Core Feature ## Aggregate report analysis Raw DMARC XML becomes a visual dashboard showing every sender, their authentication status, and your enforcement readiness. Reports arrive daily from receivers worldwide and are processed automatically. 200+ Vendors auto-classified Every sending source mapped to a known vendor or flagged for investigation. 94.2% Avg. pass rate visibility See DMARC, SPF, and DKIM pass rates across all sources at a glance. 30 days Trend analysis window Track authentication rates over time to spot regressions early. Instant Actionable recommendations Prioritized next steps to improve alignment and move toward enforcement. Forensic Reports ## Investigate every failure in detail Forensic reports give you per-message failure details. See the exact sender IP, the header mismatch, the mechanism that failed, and what the receiver did with the message. Follow the investigation flow from alert to resolution. 1\. Alert received Authentication failure detected from unrecognized source IP 91.203.145.22 2\. Investigate headers From: ceo@yourdomain.com, Return-Path: bounce@malicious-server.ru - domain mismatch confirmed 3\. Confirm rejection DMARC policy p=reject enforced. Spoofed message blocked before reaching the recipient inbox. Forensic Report Detail From ceo@yourdomain.com spoofed Source IP 91.203.145.22 unauthorized Return-Path bounce@malicious-server.ru mismatch SPF Result fail (not in SPF record) fail DKIM Result fail (no valid signature) fail DMARC Disposition reject enforced Step by Step ## How to read a DMARC report Five steps from raw XML to concrete action. DMARC Report automates every step, but understanding the process helps you make better decisions. 1 ### Receive XML Mailbox providers send gzipped XML reports to your rua= address daily. Each report covers a 24-hour window. 2 ### Parse Tags Extract key metadata - reporting org, date range, your published policy, and each record row with source IP and auth results. 3 ### Identify Sources Map source IPs to known senders. Classify each as authorized (Google, Microsoft, SendGrid) or unknown/suspicious. 4 ### Check Alignment Verify SPF and DKIM alignment for each source. Aligned = the authenticated domain matches the From header domain. 5 ### Take Action Fix misaligned senders, authorize legitimate sources, and move toward enforcement (p=quarantine or p=reject). Reference ## DMARC record tags explained Every tag that appears in a DMARC DNS record, with its purpose and an example value. Your DMARC record is a TXT record published at \_dmarc.yourdomain.com. v= v=DMARC1 Protocol version identifier. Always DMARC1 for current implementations. p= p=reject Domain policy - tells receivers what to do with failing mail: none, quarantine, or reject. rua= rua=mailto:dmarc@example.com Aggregate report URI. Where receivers send daily XML summary reports. ruf= ruf=mailto:forensic@example.com Forensic report URI. Where receivers send per-message failure reports. sp= sp=quarantine Subdomain policy. Overrides the domain policy for subdomains if specified. adkim= adkim=s DKIM alignment mode. Strict (s) requires exact domain match; relaxed (r) allows subdomain match. aspf= aspf=r SPF alignment mode. Strict (s) requires exact domain match; relaxed (r) allows subdomain match. pct= pct=100 Percentage of messages subject to the DMARC policy. Useful for gradual rollout. fo= fo=1 Forensic report options. Controls when forensic reports are generated (0, 1, d, s). ## Start analyzing your DMARC reports today Free trial - no credit card required. See your first report within 24 hours of setup. [Start Free Trial](https://app.dmarcreport.com/) ## What Security Teams Say About Our Reporting ![G2 Leader - DMARC](https://media.mailhop.org/dmarcreport/images/g2-badges/DMARC_Leader_Leader.png) Rated 4.8/5 on G2 · 469 verified reviews ![G2 Momentum Leader - DMARC](https://media.mailhop.org/dmarcreport/images/g2-badges/DMARC_MomentumLeader_Leader.png) DG Dave G. Owner 5/5 ### "DMARC Report has been invaluable in fixing email deliverability issues for our clients" DMARC Report dashboard allows us to see easily what is compliant and what isn't compliant so we can quickly fix issues. 9/27/2022Verified on G2 ZK Zunaid K. Director 5/5 ### "Essential tool for email delivery" This tool helps us to implement DMARC reporting for our domains in an easy to use manner. 8/8/2024Verified on G2 VU Verified User in Information Technology and Services 5/5 ### "Best security tool for your own domains" The weekly reports help me a lot to analyze quickly the emails sent from my domains and that gives me peace of mind. 8/31/2022Verified on G2 [Read all 469 reviews on G2 →](https://www.g2.com/products/dmarc-report/reviews) ```json {"@context":"https://schema.org","@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com","logo":{"@type":"ImageObject","url":"https://dmarcreport.com/images/dmarcreport-logo.png"},"description":"DMARC reporting and email authentication management. Monitor aggregate and forensic DMARC reports, analyze authentication results, and enforce DMARC policies across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138898167","https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://www.g2.com/products/dmarc-report/reviews","https://github.com/duocircle","https://www.crunchbase.com/organization/duocircle-llc","https://www.trustradius.com/products/duocircle/reviews"],"aggregateRating":{"@type":"AggregateRating","ratingValue":"4.8","reviewCount":"470","bestRating":"5","worstRating":"1","url":"https://www.g2.com/products/dmarc-report/reviews"},"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://dmarcreport.com/support/"},"knowsAbout":["DMARC","DMARC Reporting","DMARC Aggregate Reports","DMARC Forensic Reports","Sender Policy Framework","DKIM","Email Authentication","Email Security","DNS Management","Email Deliverability"]} ``` ```json {"@context":"https://schema.org","@type":"WebSite","name":"DMARC Report","url":"https://dmarcreport.com","description":"DMARC reporting and email authentication management. Monitor aggregate and forensic DMARC reports, analyze authentication results, and enforce DMARC policies across all your domains.","publisher":{"@type":"Organization","name":"DMARC Report","url":"https://dmarcreport.com","logo":{"@type":"ImageObject","url":"https://dmarcreport.com/images/dmarcreport-logo.png"},"description":"DMARC reporting and email authentication management. Monitor aggregate and forensic DMARC reports, analyze authentication results, and enforce DMARC policies across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}}} ``` ```json [{"@context":"https://schema.org","@type":"WebPage","name":"DMARC Reporting - Aggregate & Forensic Report Analysis | DMARC Report","description":"Turn raw DMARC XML into actionable intelligence. Analyze aggregate (RUA) and forensic (RUF) reports, identify unauthorized senders, check alignment, and move toward DMARC enforcement with DMARC Report.","url":"https://dmarcreport.com/dmarc-report/","isPartOf":{"@type":"WebSite","name":"DMARC Report","url":"https://dmarcreport.com"}}] ``` ```json {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://dmarcreport.com/"},{"@type":"ListItem","position":2,"name":"Features","item":"https://dmarcreport.com/features/"},{"@type":"ListItem","position":3,"name":"DMARC Reporting","item":"https://dmarcreport.com/dmarc-report/"}]} ```