# Do I need to read my DMARC reports?

**IDEALLY**—rua, at minimum

> Publishing DMARC without reading the reports is buying a smoke alarm and never checking the battery. The aggregate reports are where misconfigured senders and spoofers show up first.

Reporting is the R in DMARC, and it's the part that makes the rest work: [the policy](https://doineed.email/dmarc) protects your domain, but the reports are how you find out what the policy is actually doing—and whether it's safe to [tighten it](https://doineed.email/dmarc-p-reject).

## Two report types, one worth your time

- **RUA (aggregate)**—daily summaries from every receiver that saw mail claiming to be you: which sources sent, whether SPF/DKIM passed and aligned, and what the receiver did about it. This is the one to read.
- **RUF (forensic)**—a per-failure report with message details. Don't build your monitoring on these: Gmail and Outlook don't send them for privacy reasons, volume can be overwhelming when something breaks, and delivery is batched anyway. Enable them only while investigating a specific incident.

## What the aggregates actually tell you

Three things you can't see anywhere else:

1. **Every source sending as your domain**—including the CRM, billing tool, or survey platform someone connected and forgot. These are exactly the senders that break the day you enforce.
2. **Authentication gaps**—sources that send legitimate mail but fail alignment, quietly eroding your delivery.
3. **Spoofing attempts**—unauthorized senders wearing your domain, which is the abuse DMARC exists to stop.

One subtlety worth knowing: your published policy is a *request*. The report's `disposition` field shows the receiver's actual *decision*, and the two don't always match. The reports are where you learn how the world really treats your mail.

## Nobody reads raw XML (use a tool)

Reports arrive as XML attachments, often gzipped, and reading them by hand is penance. Resend open-sourced a [DMARC Analyzer](https://github.com/resend/resend-dmarc-analyzer) you can run yourself—it ingests RUA reports via inbound webhooks (compressed attachments included), gives you a paste-and-analyze UI, and can email you digests.

## The verdict logic

This is an *ideally* because a small sender with one ESP and `p=none` can survive without ritual report-reading. But the reports cost nothing—one `rua=` tag in the record you're publishing anyway—and everyone touching enforcement, multiple sending tools, or a spoofing-prone brand should be reading them. The smoke alarm is free; check the battery.

---

- Canonical: https://doineed.email/dmarc-reports
- Learn more: https://resend.com/blog/how-to-read-a-dmarc-report
- All questions: https://doineed.email/llms.txt

An opinionated answer from the [Resend](https://resend.com) team.