Where do DMARC reports actually get sent?

To the address (or addresses) listed in the rua tag of your DMARC TXT record — receiving mail servers that see that tag send periodic XML reports there, usually once a day.

Do I need special software to read a DMARC report?

Not strictly, but in practice yes — reports arrive as gzip- or zip-compressed XML, and reading raw XML by hand doesn't scale past a handful of messages. A parser or dashboard that renders them as a table is the practical approach.

How do I know if a source failing authentication is legitimate or an attacker?

Cross-check the source against services you actually use for that domain — a marketing tool or CRM you forgot to add to your SPF record looks identical in a report to genuine abuse until you recognize (or fail to recognize) the sending source yourself.

How to Read DMARC Aggregate Reports

A DMARC record with a rua address asks every receiving mail server for a periodic report on what it saw. Those reports are the only way to know which sending sources exist for your domain before deciding whether it's safe to reject anything that fails.

What a DMARC Report Is

Receiving mail servers that see your rua address in DNS send back an XML report, usually daily, summarizing every message they processed claiming to be from your domain — a rolling census of exactly who is sending mail as you.

Why They Matter

Without reports, moving to p=reject is a guess. Reports show every sending source in use for your domain — the legitimate ones you configured, the legitimate ones you forgot about, and anything unauthorized — so you can fix or add SPF/DKIM coverage before enforcement starts blocking real mail.

What's Actually Inside

Each report identifies the reporting organization and includes one record per source IP: how many messages it sent, what disposition DMARC applied, and the SPF and DKIM results and the domains those checks were evaluated against.

Reading the Raw File

Reports arrive as gzip- or zip-compressed XML attachments, which is why almost nobody reads them by hand — a parser or dashboard that turns the XML into a readable table is the practical way to work with a real volume of reports.

What to Look For

A source you recognize as legitimate but that's failing SPF or DKIM — usually a missing SPF include or an unconfigured DKIM selector that needs fixing
A source you don't recognize at all sending as your domain — a potential spoofing attempt or unauthorized use worth investigating before it's blocked outright

Analyze a DMARC Report

Analyze a DMARC report →Next: Reading email headers →

Try it on your domain

See the theory in practice — run a DMARC Report Analyzer for your own domain.