How to Read DMARC Reports Without Getting Lost
DMARC aggregate reports show who sent mail as your domain and whether SPF and DKIM passed. Learn how to read the XML, spot unknown senders, and decide when to tighten policy.
DMARC aggregate reports are XML summaries that receiving mailbox providers send to the address in your rua= tag. They tell you which IPs sent mail claiming to be your domain, whether SPF and DKIM passed, and whether those results aligned with the From domain.
Reading reports is the difference between a safe move to p=reject and an outage that blocks your own invoices. Use this guide alongside DMARC policy explained and verify DNS with the DMARC checker.
What arrives in your inbox
- Usually a ZIP or gzip attachment containing XML.
- One report per reporting organisation per period (often daily).
- Volumes that look scary at first; focus on unique source IPs and failure reasons, not raw counts alone.
Fields that matter first
- 1Header From / domain - the domain being protected.
- 2Source IP - who actually sent the traffic.
- 3SPF and DKIM results - pass or fail at the authentication layer.
- 4Alignment - whether passes count for DMARC on the From domain.
- 5Disposition - what the receiver did under your current policy.
An ESP can pass SPF for a return-path domain that does not align. The report will show authentication success that still fails DMARC. Fix alignment, not only SPF syntax.
How to triage unknown sources
- Look up the IP or organisation; many are known ESPs you forgot to authorise.
- Match traffic spikes to product launches, billing runs, or support tools.
- Treat random consumer ISPs and hosting ranges with failed auth as likely spoofing.
- Do not jump to
p=rejectwhile a legitimate weekly newsletter still fails.
Tools that make XML readable
Raw XML is fine for a quick look; most teams eventually use a DMARC report parser or mailbox that charts sources over time. Whatever tool you choose, keep the underlying DNS accurate. PatchPings helps confirm SPF, DKIM, and DMARC records via scans and the DMARC checker; report content itself still comes from mailbox providers to your rua address.
When reports say you are ready
- 1Every legitimate sender shows passing, aligned DKIM or SPF.
- 2Remaining failures look like spoofing or noise, not your CRM.
- 3You have watched at least one full business cycle (invoices, password resets, campaigns).
- 4Then move policy per DMARC setup step-by-step.
Reports are a feedback loop. Read them until the story is boring: only your servers pass, and everyone else fails. That boredom is the green light for quarantine and reject.
