- How often are DMARC reports sent?
- Aggregate reports arrive about once a day. Each mailbox provider that receives mail claiming to be from your domain batches a day's activity into one XML summary sent to your rua address, so with several large providers you'll get a handful daily. The interval is requested by the ri tag (default 86400 seconds, i.e. 24 hours), though most receivers send daily regardless. Failure/forensic reports (ruf) are different: they're generated per failing message in near-real-time, but most large providers don't send them at all.
- Aggregate vs failure (forensic) reports — what is the difference?
- Aggregate (rua) reports are periodic XML summaries with per-source-IP counts, the disposition applied and SPF/DKIM alignment results — no message content or recipients. They show who sends as your domain and whether they authenticate. Failure/forensic (ruf) reports are per-message and near-real-time, carrying redacted message-level detail (headers, the failing authentication result, source IP) for drilling into a single failure. Aggregate reports are sent widely; forensic reports are rare, because privacy concerns mean Google, Microsoft and most others don't send them.
- What is the fo tag?
- fo (failure reporting options) controls when a failure/forensic report is generated, and only applies if you set a ruf address. fo=0 (the default) reports only when both SPF and DKIM fail to produce an aligned pass; fo=1 (recommended) reports when either fails alignment; fo=d reports on a DKIM signature failure; fo=s on an SPF failure. You can combine them, for example fo=1:d:s. It has no effect on aggregate reports.
- What is in an aggregate report and how do I read it?
- The header shows who reported, the date range and your published policy (p, sp, pct, adkim, aspf). Each row is one sending IP: how many messages it sent, the disposition the receiver applied (none, quarantine or reject) and whether SPF and DKIM aligned. Read it source by source — confirm each IP is a legitimate sender, then get any legitimate source that isn't aligned to pass SPF or DKIM alignment. Once your real senders align cleanly, raise your policy from none to quarantine to reject.