DMARC Reports Explained: How to Read Them and Fix Problems

Once you publish a DMARC record, mailbox providers start sending you reports about the email claiming to come from your domain. They look like walls of XML, but they hold the key to better deliverability and stopping spoofing. Here is how to read them without a degree in email.

If you have not set up DMARC yet, start with SPF, DKIM and DMARC explained.

Two kinds of reports

Aggregate reports (RUA): daily XML summaries of how much mail passed or failed SPF and DKIM for your domain, and from which sources. These are the useful ones for tuning.
Forensic reports (RUF): individual failure samples. Many providers no longer send these for privacy reasons, so do not rely on them.

What the aggregate report tells you

Each report lists sending sources (IP addresses) and, for each:

How many messages were seen
Whether SPF passed and aligned with your domain
Whether DKIM passed and aligned
What DMARC verdict was applied (pass / fail)

Your goal: every legitimate source should pass SPF and/or DKIM with alignment. Anything failing is either a misconfiguration to fix or an impersonator to block.

Reading it in three questions

Are my real senders passing? Identify your own mail (your email host, plus any tools that send as you - newsletters, invoicing, CRM). Confirm each passes and is aligned.
What is failing, and is it mine? A failing source you recognise means an alignment fix (add it to SPF, enable DKIM for it). A failing source you do not recognise is likely spoofing - which DMARC will block as you tighten policy.
Am I ready to enforce? Once all legitimate mail passes cleanly, you can move your policy from monitoring to enforcement.

Tightening your policy safely

DMARC has three policy levels:

p=none - monitor only (start here and read reports)
p=quarantine - send failing mail to spam
p=reject - block failing mail outright

Move up gradually. Only advance to quarantine, then reject, once your reports show every legitimate source passing - otherwise you risk blocking your own mail.

Make it easy on yourself

Raw XML is painful to read by hand. Free DMARC report readers turn the files into simple dashboards. And a good email host helps you get SPF, DKIM and DMARC aligned in the first place, so your reports are clean from the start.

The takeaway

DMARC reports are a feedback loop: publish p=none, read who passes and fails, fix your real senders, then tighten to reject. Do that and you lock impersonators out of your domain while keeping your own mail flowing - the foundation of good deliverability.

Want your domain authenticated and monitored properly? Contact us.