Lesson 3 of 3
Reading DMARC reports
2 min
With rua= set, mailbox providers send you aggregate reports every day, usually as XML attachments.
What a report tells you
For each sending IP that used your domain:
- How many messages it sent
- Whether they passed SPF and passed DKIM
- Whether they were aligned: the domain that passed matches your visible From address
- What the receiver did: delivered, quarantined or rejected
How to use them
- Use a free DMARC report viewer rather than reading XML by hand.
- List every source that sends as you. Expect your mail provider, your website, newsletters, CRM and invoicing.
- For each legitimate source that fails, fix it: add it to SPF, or turn on DKIM signing in that tool.
- Unknown sources that fail are usually spoofing attempts. That's exactly what DMARC will block.
Watch reports for two to four weeks before tightening the policy. Monthly senders, like billing runs, are easy to miss in a few days.
Moving to enforcement
When every legitimate source passes, change p=none to p=quarantine; pct=25, raise pct gradually to 100, then switch to p=reject.