How to Set Up DMARC Reporting and Analysis

DMARC reporting provides detailed data about who is sending email on behalf of your domain and whether authentication is passing.

How DMARC reporting works

When you publish a DMARC record with a reporting address (rua tag), email providers send you aggregate reports in XML format. These reports detail every email sent from your domain, whether it passed SPF and DKIM, and which IP addresses sent the emails.

Setting up DMARC reporting

Add a DMARC record with the rua tag

v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com("mailto:dmarc-reports@yourdomain.com") This tells email providers to send aggregate reports to that address. Start with p=none (monitoring only) so you receive reports without affecting email delivery.

Analyzing DMARC reports

Raw DMARC reports are XML files that are difficult to read manually. Use a DMARC report analyzer: DMARC Analyzer (dmarcanalyzer.com), Postmark DMARC (free weekly digests), or Valimail.

What to look for in reports

Authentication failures: Any emails failing SPF or DKIM need investigation. They might be from misconfigured legitimate services or unauthorized senders. Unknown sending sources: IP addresses you do not recognize sending from your domain could indicate unauthorized use (spoofing). Volume anomalies: Unexpectedly high volume from your domain may indicate compromise.

Progression to enforcement

After monitoring for 2 to 4 weeks and confirming all legitimate email passes authentication: Move from p=none to p=quarantine (suspicious emails go to spam). After another 2 to 4 weeks of clean data: Move to p=reject (unauthorized emails are blocked entirely). Verify your progression using the DMARC Checker.

---

Need pre-warmed inboxes ready to send today? Warm Inboxes includes free .com domains and 24/7 support. Used by agencies doing 10,000+ emails per day. Check your deliverability free →