What is RFC 9991 (DMARC failure reporting)?

An aggregate report tells you something failed. A failure report can show you what failed. That's useful, and it's also the problem.

RFC 9991 defines DMARC failure reports, the ones you may also know as forensic reports. They usually go out almost immediately after a receiver detects a DMARC failure, with no wait for the aggregate report. They help you work out why something failed, and spot direct abuse of your domain quickly.

You ask for them with ruf=, and fo= says which failures you want reported. Both tags are in RFC 9989. Receivers may choose whether to follow your fo= options, and they decide which reports to send, if any. RFC 9989 removed the old rf= format tag.

Here's the catch. A failure report can include the headers or even the entire message, and that can include personal information. The RFC gives examples like product launches and employee termination notices. Reports can also expose mailing list members, or forwarding addresses you never knew about. It says many large providers limit failure reports or disable them entirely, and that aggregate reports remain the recommended way to see your authentication results.

If you do turn them on, the RFC encourages you to:

• Limit them to a specific diagnostic job, for a limited time
• Keep tight control of the addresses in ruf=
• Redact message bodies and headers where you can
• Send reports only over secure channels

If you receive them, keep them apart from your other mail, open them in a sandbox and limit who can access them. Reports can carry real spam, phishing or malware.

A few more rules worth knowing:

• An address on another domain has to confirm it accepts your reports, using the same check as RFC 9990.
• Report generators must rate-limit, so you don't get flooded.
• ruf= on a record with psd=y isn't considered, unless the parties have a specific agreement.
• Failure report email should itself be DMARC-aligned, because unaligned reports could cause mail loops.

The format builds on RFC 6591. RFC 9991 adds a required Identity-Alignment field, listing which methods failed to authenticate an aligned identity, and a dmarc failure type.

Want to see whether your record asks for failure reports? Check it with our free DMARC Parser. Not sure if you should? Our SOS hotline is a free place to get a second opinion.