How to read a DMARC aggregate (RUA) report

Once DMARC is on, mailbox providers send you daily aggregate reports — dense XML files summarizing who sent mail as your domain and whether it passed. They're the map you use to reach enforcement. Here's how to read them.

What an aggregate report is

Each report is an XML file from one mailbox provider (Google, Microsoft, Yahoo, and others), covering one day. It does not contain message content — just counts: how many messages claimed to be from your domain, from which IPs, and whether they passed SPF, DKIM and DMARC.

The parts that matter

Report metadata — who sent the report (the org_name) and the date range.
Policy published — the DMARC policy they saw for your domain (p, sp, pct), so you can confirm it's what you intended.
Records — one block per sending source: the source IP, a message count, the disposition (none / quarantine / reject) actually applied, and the SPF and DKIM results plus whether each was aligned with your From domain.

How to read a record block

For each source, ask three questions:

Do I recognize this IP? Map it to a real sender (your mail host, CRM, marketing tool). Unknown sources are either shadow IT or potential abuse.
Did DMARC pass? DMARC passes if either SPF or DKIM passes and is aligned. "SPF pass" alone isn't enough if it isn't aligned.
What was the disposition? At p=none it'll say none even for failures — that's the gap you're closing.

What to look for before you enforce

Legitimate senders failing — fix these (SPF/DKIM/alignment) before moving the policy up.
Sources you can't identify — investigate; these are why you watch reports before moving to reject.
Volume from your real senders all passing — your green light to advance.

Reading them at scale

One domain's XML is manageable by hand; several domains across many providers is not. Most teams use a DMARC analytics service — or a managed provider — to parse the XML, group by sender, and surface only what needs action.

Frequently asked questions

What's the difference between rua and ruf in DMARC?

rua is the address for aggregate reports — daily XML summaries of pass/fail counts by source. ruf is for forensic (failure) reports, which include sample data from individual failing messages. Most organizations rely on rua; ruf is sent by few providers and can carry privacy concerns.

Why is my own legitimate mail failing in DMARC reports?

Usually because a sender isn't fully authenticated or isn't aligned — for example mail sent through a tool that isn't in your SPF record or isn't DKIM-signing with your domain. Aggregate reports are how you find these senders so you can fix them before enforcing.

Do I need a tool to read DMARC reports?

For one small domain you can read the raw XML, but volume adds up fast across providers. A DMARC reporting/analytics service (or a managed service) parses the XML, groups by sender, and turns it into a readable picture — which is what most teams use.

Skip the XML — get a readable report

StopForge's free exposure scan reads your live records and shows exactly where your email authentication stands — what passes, what silently fails, and whether anyone can still send as your domain. No changes to your mail, no obligation.

See if your domain can be spoofed

← All guides