Reporting is the R in DMARC, and it’s the part that makes the rest work: the policy protects your domain, but the reports are how you find out what the policy is actually doing—and whether it’s safe to tighten it.
Two report types, one worth your time
- RUA (aggregate)—daily summaries from every receiver that saw mail claiming to be you: which sources sent, whether SPF/DKIM passed and aligned, and what the receiver did about it. This is the one to read.
- RUF (forensic)—a per-failure report with message details. Don’t build your monitoring on these: Gmail and Outlook don’t send them for privacy reasons, volume can be overwhelming when something breaks, and delivery is batched anyway. Enable them only while investigating a specific incident.
What the aggregates actually tell you
Three things you can’t see anywhere else:
- Every source sending as your domain—including the CRM, billing tool, or survey platform someone connected and forgot. These are exactly the senders that break the day you enforce.
- Authentication gaps—sources that send legitimate mail but fail alignment, quietly eroding your delivery.
- Spoofing attempts—unauthorized senders wearing your domain, which is the abuse DMARC exists to stop.
One subtlety worth knowing: your published policy is a request. The report’s disposition field shows the receiver’s actual decision, and the two don’t always match. The reports are where you learn how the world really treats your mail.
Nobody reads raw XML (use a tool)
Reports arrive as XML attachments, often gzipped, and reading them by hand is penance. Resend open-sourced a DMARC Analyzer you can run yourself—it ingests RUA reports via inbound webhooks (compressed attachments included), gives you a paste-and-analyze UI, and can email you digests.
The verdict logic
This is an ideally because a small sender with one ESP and p=none can survive without ritual report-reading. But the reports cost nothing—one rua= tag in the record you’re publishing anyway—and everyone touching enforcement, multiple sending tools, or a spoofing-prone brand should be reading them. The smoke alarm is free; check the battery.