Guide
How to read a DMARC aggregate (RUA) report
DMARC reports are how you find out who is really sending email as your domain — but providers send them as compressed XML. Here's what's inside and how to actually read it.
Analyze a DMARC report free →What it is
A DMARC aggregate report (the "rua" in your DMARC record) is an XML file that a receiving provider — Google, Microsoft, Yahoo and others — sends you, usually once a day, summarising every source that sent email using your domain and whether it passed SPF, DKIM and DMARC alignment.
It is not a copy of your emails. It contains no message content — just counts of messages per sending IP, the authentication results, and the DMARC policy that was applied.
Providers send it gzip-compressed (.gz or .zip) with the raw report as XML, which is why it looks unreadable when it lands in your inbox.
Why it matters
The report is the only way to see the full list of everything sending as your domain — your own mail provider, your CRM, invoicing and helpdesk tools, and anyone spoofing you — before you tighten your DMARC policy.
Moving to p=quarantine or p=reject without reading your reports first is how people accidentally block their own legitimate mail. The report tells you which senders still need SPF/DKIM fixed so enforcement is safe.
It also shows spoofing: sources failing DMARC that are not yours. Those are exactly what enforcement is meant to block — so failing spoof traffic is a sign DMARC is working, not broken.
How to set it up
- 1Open the report. If it's a .gz or .zip attachment, decompress it to get the XML (or paste/drop it straight into our analyzer, which decompresses in your browser).
- 2Read the <report_metadata>: who sent the report (org_name, e.g. google.com) and the date range it covers.
- 3Read the <policy_published>: the DMARC policy the receiver saw for your domain — p (none/quarantine/reject), and the sp/pct/adkim/aspf tags.
- 4Read each <record> row: the <source_ip> that sent mail, the <count> of messages, and the <policy_evaluated> result — did SPF and DKIM align and pass?
- 5Group the rows by sender. For every source that is yours but failing, fix its SPF or DKIM alignment. For sources that aren't yours and are failing, that's spoofing — leave it to be blocked by enforcement.
- 6Once every legitimate sender passes, raise your policy toward p=reject with confidence.
Common problems
- Why can't I just open the DMARC report?
- Because providers send it as gzip-compressed XML designed for software, not humans. You have to decompress it and parse the source rows. Our free DMARC report analyzer does both in your browser (nothing is uploaded) and shows it in plain English.
- What does an IP failing DMARC in the report mean?
- It means a server sent mail as your domain that didn't pass SPF or DKIM alignment. If it's one of your services, it needs authenticating. If it's not yours, it's spoofing — and enforcement (p=reject) is what stops it reaching inboxes.
- How do I tell real senders from spoofers in the report?
- A legitimate sender usually shows some DMARC-aligned volume or resolves to a recognised email provider; pure spoofing shows only failing volume from unrelated IPs. Our analyzer splits the two automatically so you know which failures are a real fix and which are expected.
- How often do DMARC reports arrive?
- Most large receivers send one aggregate report per day per domain, so you'll accumulate several daily once your rua address is published. A single report is a snapshot; trends across days are what you act on.
Check it — then keep it healthy
Run a free scan now, or let DomainHealthPro monitor it continuously and alert you the moment it breaks.