Making DMARC reports readable
Use reports to find and fix legitimate senders before tightening your policy.
New to any of these words? Start here
- Your domain
-
The part of your email address after the @, and usually your website address too. For
fundraising@example.orgthe domain isexample.org. - DNS
- The internet's address book. It answers questions about your domain: which server hosts the website, where email should be delivered, and who is allowed to send email as you. Anyone can look up your DNS, which is why this check needs nothing from you but the domain name.
- Nameservers
- The machines that hold your domain's address book and answer those questions. Whoever runs them is where you make the changes below. It is often not the company you bought the domain from — the check tells you which one it is.
- A DNS record
- One entry in that address book: a name, a type, and a value. You add them through a web form at whoever runs your nameservers. Nothing is installed and nothing runs on your computer.
- TXT and CNAME records
- Two of the types. A TXT record holds a line of text, which is how SPF and DMARC are published. A CNAME points one name at another, which is how Microsoft publishes DKIM.
- SPF
- Lists the servers allowed to send email using your domain.
- DKIM
- Adds a signature to your outgoing mail, so a receiving server can tell the message really came from you and has not been altered on the way.
- DMARC
- Ties the other two to the name your reader actually sees, and tells receiving servers what to do when a message fails: nothing, send it to spam, or refuse it.
Mail providers may send you reports showing which sources use your domain and whether they pass DMARC. They arrive as zipped XML; a reporting service turns them into a readable summary. Use that evidence to find legitimate senders that need fixing before you tighten your policy.
Where to send reports
Put a working mailbox or a reporting service's address in your record's rua= tag.
Multiple addresses can be separated by commas. An address on another domain requires that
domain to publish a record authorizing reports for you; reporting services usually handle this.
The check verifies that authorization.
Reports are not compulsory. If none arrive, check that the mailbox works and any external authorization is in place. Silence is not the evidence you tighten a policy on.
Reporting services
Check current terms before signing up.
- Cloudflare DMARC Management is free, including on Cloudflare's free plan. Your domain's DNS must be hosted there.
- EasyDMARC offers paid monitoring with a free trial. Check the history limit: a short clean window cannot show a quarterly sender that has not sent yet.
- dmarcian offers nonprofit pricing on request. Its free plan is for personal use, so organizations need a paid plan.
If you have technical help, open-source tools can also parse the XML reports.
How long to monitor
There is no fixed answer. Wait until reports cover your sending cycle and every legitimate source is passing. Ask finance, fundraising and campaigns who sends using your domain: annual receipts and quarterly campaigns may simply not appear during your monitoring window. Fix known senders that fail before tightening.
Where you're heading
The destination is p=quarantine, which asks receivers to put failing mail in spam.
Each receiver decides how to handle it. Quarantine is far enough for most organizations.
Mailing lists relay from their own servers while leaving your address in the From line;
their footers or subject changes can break DKIM too. Genuine list mail can therefore fail DMARC.
If you do decide on reject, RFC 9989 §7.4 calls for working DKIM and at least a month each
at p=none and p=quarantine, comparing reports before going further.
It advises against p=reject for domains whose people post to mailing lists,
because genuine mail can be refused.