What is RFC 9990 (DMARC aggregate reporting)?

Aggregate reports are how you discover every service sending as your domain. RFC 9990 is the rulebook for those reports.

RFC 9990 defines what's inside a DMARC aggregate report and how it gets to you. RFC 7489 used to cover this along with everything else. It was split into three documents so each piece can be changed later without reopening the rest. You ask for reports with the rua= tag. No tag, no reports.

A report comes daily or more often, as an XML file that should be gzipped. It covers one domain's policy and can show:

• The DMARC policy found and what was done with the mail
• The domains and results SPF and DKIM checked, and whether each aligned
• Counts of messages, including mail later blocked by other filters

It doesn't include individual email addresses, the IP addresses of individuals, or message content. That's what makes these reports different from failure reports.

What changed from RFC 7489:

• The report structure is clearer, so reports should be more consistent.
• The report ID has more structure, and it has to be unique among reports to the same domain.
• One report covers one policy domain.
• Reports can carry extensions.
• A DKIM result now has to include the selector.
• Public suffix domains are now part of the spec.

Two new fields are handy if you're tracking the update. discovery_method says whether the receiver used the old Public Suffix List or the new tree walk. testing shows your t= value, and policy_test_mode marks mail exempted because of it. And since RFC 9989 removed ri=, you can no longer use a tag to ask for a reporting interval.

If you change your record, expect a messy report or two. A receiver may report on the old policy, a mix of both, or send separate reports for the same period.

Sending reports to another company? That address has to agree to it. If your rua= points to a different organizational domain, the receiver looks for a TXT record at yourdomain.com._report._dmarc.thirdparty.com containing v=DMARC1. No confirmation, no report to that address. A reporting service can publish a wildcard record to accept reports for any domain.

Raw XML isn't fun to read. Our free DMARC Parser translates reports into something readable. And if something in there looks off, our SOS hotline is a free place to get a second opinion.