DMARC aggregate reports
Aggregate reports are XML files that receiving domains send to the address in your rua tag. They show who is sending mail as your domain, and whether it passes or fails.
The reports
XML files that show who sends as your domain.
When a DMARC record includes
rua=mailto:dmarc@example.com, receiving
domains send aggregate reports to that address. Each report
is a gzipped XML file covering a reporting period (usually
24 hours) and listing every source IP that sent mail
claiming to be from your domain.
What a report contains
- Source IPThe server that sent the message.
- CountHow many messages came from that IP in the period.
- SPF result and alignmentWhether SPF passed and whether the envelope domain aligned with the From domain.
- DKIM result and alignmentWhether DKIM passed and whether the signing domain aligned.
- DMARC dispositionWhat the receiver did: none, quarantine, or reject.
How to read them
Raw DMARC XML is dense. Free viewers parse the files and show tables and charts instead. Look for sources you do not recognise: they are either legitimate senders you forgot to authorise, or someone spoofing your domain. Authorise the former in SPF and DKIM, and let DMARC reject the latter.
What can go wrong
Related findings.
| Finding | What it means |
|---|---|
dmarc_no_aggregate_reports
|
No DMARC aggregate reports |
dmarc_missing
|
No DMARC record |
More guides
Keep reading.
How SPF works
SPF declares which servers may send mail for a domain. A TXT record in DNS lists IP addresses and includes, and a receiver evaluates them in order.
How DKIM works
DKIM attaches a cryptographic signature to each message. The receiver fetches the public key from DNS and verifies that the message was not altered after signing.
How DMARC works
DMARC ties SPF and DKIM together by requiring that at least one of them aligns with the From header domain. It tells receivers what to do when neither does.
SPF, DKIM and DMARC alignment
Authentication alone is not enough. DMARC requires that the domain authenticated by SPF or DKIM matches the domain in the From header the recipient sees.
DKIM selectors explained
A selector is the label that tells the receiver which public key to fetch from DNS. Different services use different selectors, and rotating them is how you change keys without downtime.
The SPF 10-lookup limit
Every include, a, mx, ptr and exists mechanism in an SPF record costs one DNS lookup. The specification caps the total at ten, and exceeding it is a permanent error.