How to read DMARC aggregate reports
DMARC aggregate reports tell you who sends email in your domain's name and whether that mail passes. Read them for a few weeks and they show exactly which senders to fix before you tighten your policy.
What an aggregate report is
When you publish a DMARC record with a rua= address, receiving mail providers send you a daily XML report. Each report covers one provider and one period, and contains rows: a sending IP address, a message count, the header_from domain, and the SPF and DKIM results for those messages. Reports do not contain message content.
SPF, DKIM and alignment
DMARC passes when at least one of SPF or DKIM passes and is aligned with the visible From domain. SPF aligns when the envelope sender domain matches the From domain; DKIM aligns when the signing domain (d=) matches. A newsletter tool can pass SPF for its own domain and still fail DMARC for yours, because that pass is not aligned.
Four classes of senders
It helps to sort every source into four groups by message count: both aligned (healthy), SPF only (add DKIM signing for your domain), DKIM only (usually fine, but check the envelope sender), and neither. The last group is either a legitimate service you have not set up yet, or someone spoofing your domain.
Ranking what to fix first
Group rows by source IP, From domain and the SPF and DKIM domains, then rank by failing message count. A handful of sources usually accounts for most failures. Identify each one by its IP owner or the domains in the row: your own mail servers, your CRM, your help desk and your newsletter tool are the usual suspects. Fix the largest legitimate sender first, then re-check the next reports.
When to move from p=none
p=none collects reports but blocks nothing. Move to p=quarantine when every legitimate sender you know of passes with alignment and the remaining failures are small or clearly spoofed. Many teams step through pct= values on quarantine before moving to p=reject. Keep reading reports after each step: a new tool added by another team shows up there first.
Comparing two periods
After a fix, compare the new reports with the old ones. The useful question is not "is the pass rate higher" but "which sources stopped failing, and did any new ones appear". A before/after diff per source answers that directly.
Common pitfalls
- Forwarded mail and mailing lists often break SPF; DKIM survives forwarding better, so sign everything.
- Shared services may need a custom DKIM domain to align with yours.
- Subdomains inherit the parent policy unless you set
sp=; check them separately.
Check it automatically
DMARC Report Triage reads aggregate report XML or header-led CSV rows, groups them by source IP, From domain and DKIM/SPF domain with exact counts, splits each source into both, SPF-only, DKIM-only and neither, and suggests the fix type for its main failing class. It also gives a ramp-step verdict and a before/after diff when you paste a previous period. Three checks are free; the monthly plan is $9.