What is a DMARC aggregate report (RUA)?

Every day, mailbox providers that support DMARC send reports about the email traffic they processed from your domain. These are your DMARC aggregate reports, also called RUA reports (from the rua= tag in your record that tells providers where to send them).

The report arrives as a gzipped XML file and contains a summary of authentication results. For each sending source it saw, it tells you:

• The source IP address that sent the messages
• How many messages were sent from that IP
• Whether those messages passed or failed SPF
• Whether they passed or failed DKIM
• Whether they passed or failed DMARC alignment
• What policy was applied (none, quarantine, or reject)

That's the core of what you're looking at. The data lets you see all the services sending email on behalf of your domain and whether each one is authenticating correctly. It's the primary tool for finding rogue senders, misconfigured ESPs, or forgotten email services before they cause problems.

Raw RUA reports are gzipped XML, which is unpleasant to read directly. Most people either use a DMARC reporting service that processes and visualizes the data, or run reports through a parser. Our free DMARC parser converts the XML into a readable breakdown.

To receive RUA reports, you need rua=mailto:youraddress@yourdomain.com in your DMARC record. Without it, you won't get reports and you're essentially running DMARC blind at p=none. The reporting frequency is typically daily, but providers set their own schedules and don't always send reports for domains with very low volume.

RUA reports are different from RUF forensic reports, which are per-message failure notifications sent in near real-time. Aggregate reports give you volume and trend data. Forensic reports give you individual message samples. Most senders find DMARC aggregate reports more practically useful.