What a DMARC aggregate report contains
Mailbox providers such as Google, Microsoft and Yahoo send aggregate reports (RFC 7489) to the rua= address in your DMARC record, usually once a day. Each one is an XML file, normally gzipped or zipped and attached to an email. It lists every IP address that sent mail with your domain in the From header, how many messages each sent, whether DKIM and SPF passed and aligned, and what the receiver did with them: delivered (none), quarantine or reject. It carries no message content and no recipient addresses.
Reading the result
- A message passes DMARC when DKIM or SPF passes for a domain aligned with the From domain: the DKIM d= domain or the Return-Path domain has to be yours (relaxed alignment accepts subdomains).
- A service you use that still fails usually signs with its own domain (d=sendgrid.net, for example) or bounces to its own Return-Path. Set it up to sign with DKIM for your domain.
- Sources you do not recognise are spoofing or forwarding. Forwarders often break SPF but keep DKIM intact.
- The file is processed during the request and discarded; neither the file nor the results are saved. To have every report parsed as it arrives, with trends and a go-ahead for p=reject, monitor the domain on a paid plan.
DMARC report analyzer: questions
What is a DMARC aggregate report?+
An XML summary that mailbox providers send to the rua= address in your DMARC record, usually once a day (RFC 7489). It lists each IP address that sent mail with your domain in the From header, how many messages it sent, the SPF and DKIM results and alignment, and what the receiver did with them. It contains no message content.
How do I open a DMARC report .xml.gz or .zip file?+
Upload it to the analyzer as it arrived: the .xml, .xml.gz or .zip attachment, or the whole .eml message, up to 5 MB. The analyzer decompresses it, reads the XML and lists every sending source with its SPF, DKIM and DMARC results. You can also decompress the file yourself and read the XML in any text editor.
Why does a source fail DMARC when SPF passes?+
Because SPF passed for a domain that is not aligned with your From domain. Email services usually send with their own Return-Path, so SPF passes for their bounce domain, not yours. Set the service up to sign with DKIM for your domain, or to use a Return-Path under your domain; either gives the aligned pass DMARC needs.
What does disposition none mean in a DMARC report?+
The receiver took no DMARC action and handled the message as it normally would. That happens when the message passed DMARC, when your policy is p=none, when pct left it out, or when the receiver overrode your policy, which the report records as a reason such as forwarded, mailing_list or local_policy. Normal spam filtering still applies.
Who are the unknown IP addresses in my DMARC report?+
Usually a service you forgot, a forwarder, or someone spoofing your domain. Forwarded mail comes from the forwarder's IP and fails SPF but often keeps a valid DKIM signature; spoofed mail fails both. The analyzer labels sources of major providers from their published IP ranges and signing domains, and explains why each failing source does not align.
Is the uploaded DMARC report stored?+
No. The file is processed during the request and discarded: neither the file nor the results are saved or cached, and the page is sent with no-store caching headers. Automatic processing of every report as it arrives, with trends over time, is part of EmailSecOps monitoring on the paid plans.