Authentication
How to Read a DMARC Aggregate Report
Quick Answer
A DMARC aggregate report is an XML file summarizing which servers sent mail claiming to be from your domain, and whether each passed or failed SPF and DKIM. It helps confirm legitimate senders before tightening your DMARC policy.
DMARC reports are not designed to be read casually - they are XML data meant for either a reporting tool or careful manual review - but understanding their structure makes them far less intimidating.
Common Causes
- No reporting address (rua tag) configured, so reports are never received in the first place.
- Reports received but never reviewed, missing the chance to catch a legitimate sender failing authentication.
- Misreading a failing result as malicious when it is actually a legitimate but misconfigured internal sender.
Safe Troubleshooting Steps
- Confirm your DMARC record includes an "rua=" reporting address.
- Collect reports over at least a couple of weeks to see a representative sample.
- For each source IP, check whether it is a known, legitimate sender.
- Fix authentication for any legitimate source that is failing before tightening your policy.
What to Verify
- A reporting address is configured and receiving reports.
- Every failing source has been identified as either legitimate (needs fixing) or unknown (needs investigating).
When Professional Help May Be Useful
Reading raw DMARC XML reports at scale is genuinely tedious; if you are trying to move from monitoring to enforcement, having the reports reviewed for you can shorten that process considerably.