Turn raw XML into
actionable intelligence
DMARC aggregate and forensic reports decoded, visualized, and prioritized so you know exactly who is sending email as your domain and what to do about it.
Two report types,
one complete picture
DMARC generates two kinds of reports. Aggregate reports (RUA) give you daily summaries of all email activity across your domain. Forensic reports (RUF) give you per-message failure details when something goes wrong.
Daily XML summaries from receivers showing every source IP, authentication results, and disposition. The foundation of DMARC visibility.
Per-message failure reports with full headers, sender IP, and the exact reason authentication failed. Critical for investigating spoofing attempts.
Aggregate report
analysis
Raw DMARC XML becomes a visual dashboard showing every sender, their authentication status, and your enforcement readiness. Reports arrive daily from receivers worldwide and are processed automatically.
Investigate every
failure in detail
Forensic reports give you per-message failure details. See the exact sender IP, the header mismatch, the mechanism that failed, and what the receiver did with the message. Follow the investigation flow from alert to resolution.
Authentication failure detected from unrecognized source IP 91.203.145.22
From: ceo@yourdomain.com, Return-Path: bounce@malicious-server.ru - domain mismatch confirmed
DMARC policy p=reject enforced. Spoofed message blocked before reaching the recipient inbox.
How to read a DMARC report
Five steps from raw XML to concrete action. DMARC Report automates every step, but understanding the process helps you make better decisions.
Receive XML
Mailbox providers send gzipped XML reports to your rua= address daily. Each report covers a 24-hour window.
Parse Tags
Extract key metadata - reporting org, date range, your published policy, and each record row with source IP and auth results.
Identify Sources
Map source IPs to known senders. Classify each as authorized (Google, Microsoft, SendGrid) or unknown/suspicious.
Check Alignment
Verify SPF and DKIM alignment for each source. Aligned = the authenticated domain matches the From header domain.
Take Action
Fix misaligned senders, authorize legitimate sources, and move toward enforcement (p=quarantine or p=reject).
DMARC record tags explained
Every tag that appears in a DMARC DNS record, with its purpose and an example value. Your DMARC record is a TXT record published at _dmarc.yourdomain.com.
Protocol version identifier. Always DMARC1 for current implementations.
Domain policy - tells receivers what to do with failing mail: none, quarantine, or reject.
Aggregate report URI. Where receivers send daily XML summary reports.
Forensic report URI. Where receivers send per-message failure reports.
Subdomain policy. Overrides the domain policy for subdomains if specified.
DKIM alignment mode. Strict (s) requires exact domain match; relaxed (r) allows subdomain match.
SPF alignment mode. Strict (s) requires exact domain match; relaxed (r) allows subdomain match.
Percentage of messages subject to the DMARC policy. Useful for gradual rollout.
Forensic report options. Controls when forensic reports are generated (0, 1, d, s).
Start analyzing your DMARC reports today
Free trial - no credit card required. See your first report within 24 hours of setup.
Start Free TrialWhat Security Teams Say About Our Reporting
Rated 4.8/5 on G2 · 469 verified reviews
Dave G.
Owner
"DMARC Report has been invaluable in fixing email deliverability issues for our clients"
DMARC Report dashboard allows us to see easily what is compliant and what isn't compliant so we can quickly fix issues.
Zunaid K.
Director
"Essential tool for email delivery"
This tool helps us to implement DMARC reporting for our domains in an easy to use manner.
Verified User in Information Technology and Services
"Best security tool for your own domains"
The weekly reports help me a lot to analyze quickly the emails sent from my domains and that gives me peace of mind.