Guide

How to monitor DMARC reports

DMARC reports are the only way to know who is sending email on behalf of your domain and whether it is authenticating correctly. Here is how to read them and set up monitoring.

Get your DMARC setup checked in seconds

The free InboxProof audit runs a 7-point check (MX, SPF, DKIM, DMARC, TLS, PTR, and IP reputation) and returns a 0-100 score with a plain-English fix list. No signup.

Run the free check

What DMARC reports are

When you publish a DMARC record with a rua (aggregate) or ruf (forensic) address, mailbox providers send you XML reports about email sent to your domain. These reports tell you:

Who is sending email on behalf of your domain
Whether each message passed SPF, DKIM, or both
Whether the domains aligned with your "From" address
How many messages were sent and from which IPs

Aggregate vs forensic reports

Aggregate (rua)

Daily XML files from each provider (Gmail, Microsoft, Yahoo, etc.) summarizing all messages to your domain. This is the primary report you should monitor. It is safe to collect and does not contain personal data.

Forensic (ruf)

Per-message reports that include the actual email content. These are useful for debugging specific failures but contain sensitive data. Most providers no longer send them by default, and you should only use them if you need to investigate a specific issue.

How to read a DMARC report

Each aggregate report is an XML file with a record element for each message. The key fields are:

spf.result: pass, fail, or softfail
dkim.result: pass, fail, or none
auth_results: the raw SPF and DKIM results
source.ip: the IP that sent the message
from: the "From" domain
count: how many messages this record represents

A message is "aligned" if the SPF or DKIM domain matches the "From" domain. If neither aligns, the message fails DMARC.

How to set up monitoring

Publish a DMARC record with rua=reports@yourdomain.com (or a third-party service).
Collect the reports: Gmail sends daily, Microsoft sends hourly, Yahoo sends daily.
Parse the reports: extract the key fields (spf.result, dkim.result, source.ip, from, count).
Aggregate the data: group by sender IP and "From" domain to see who is sending on your behalf.
Alert on failures: if a new IP starts sending unauthenticated email, you want to know immediately.

What to look for

New senders: an IP you have not seen before sending email on your domain.
Authentication failures: messages that fail SPF or DKIM.
Volume spikes: a sudden increase in email volume from a known sender.
Alignment issues: messages where the "From" domain does not match the SPF/DKIM domain.

Automate it

Manually reading DMARC reports is not sustainable. The InboxProof Pro plan collects and parses your DMARC reports automatically, alerts you when a new sender appears or when authentication fails, and shows you a dashboard of your sending infrastructure. This is the difference between catching a spoofing attempt in hours versus weeks.

Start monitoring your DMARC reports

Run the free audit to see where you stand, then upgrade to Pro for automated monitoring.

Run a free audit

Want this checked automatically every day? Inboxproof Pro monitors your domain around the clock and alerts you the moment a record breaks or an IP gets listed. See pricing →