How to Read DMARC Aggregate Reports (RUA)
XML reports demystified — who sends as your domain and whether authentication passes.
DMARC reports look intimidating. They are worth opening: they reveal spoofing attempts and misconfigured tools sending as your brand.
Where the reports go
Aggregate reports are sent to the address in the rua= tag of your DMARC record. OquMail’s suggested record uses rua=mailto:dmarc@yourdomain.com, so create a dmarc@ mailbox (or change the address) if you want to receive them. Providers such as Google and Yahoo send them, usually once a day, as zipped XML attachments.
The fields that matter
- report_metadata — who sent the report and the time period it covers
- policy_published — the DMARC policy the reporter saw for your domain
- source_ip and count — which server sent mail as your domain, and how many messages
- policy_evaluated — whether DKIM and SPF passed in alignment with your domain, and what was done with the mail
- auth_results — the raw DKIM and SPF results, including which domain signed
How to act on them
- Recognised IPs failing: a service you use (CRM, billing, helpdesk) is sending as you without DKIM or an SPF entry — fix its setup
- Unknown IPs failing: probably spoofing — this is what stricter policies block
- Everything legitimate passing for a few weeks: consider moving from p=none to quarantine, then reject
Go further
For field-by-field detail see DMARC aggregate report XML fields explained, and for tightening your policy safely see the 30-day plan from none to reject.
Want to see how your own domain is set up? Use the free SPF checker and DMARC checker: they run in your browser and store nothing.