Understanding DMARC Reports
Learn how to read and act on DMARC aggregate reports.
Understanding DMARC Reports
When your DMARC record includes Mailnaptic’s reporting address in rua, ISPs send daily aggregate reports in XML format. Mailnaptic ingests and summarizes these reports so you do not have to parse XML manually. DMARC reports are available on the Pro plan and above.
What Reports Contain
Each aggregate report includes:
- Reporting organization — The ISP or mail provider that generated the report (e.g., Google, Yahoo, Microsoft).
- Date range — The period the report covers, typically 24 hours.
- Source IPs — IP addresses that sent email using your domain.
- SPF result — Pass or fail for each source.
- DKIM result — Pass or fail for each source.
- Disposition — What the ISP did with the email (none, quarantine, reject).
Viewing Reports in Mailnaptic
- Go to Domains → Sending domains and expand your domain.
- In the DMARC Policy Enforcement section, click View reports (the button changes to Refresh reports once loaded).
- You will see summary figures for passes, failures, pass rate, and number of reports, followed by a table with the columns Reporter, Source IP, SPF, DKIM, Disposition, Pass/Fail, and Period.
If no reports have arrived yet, the section tells you so. Reports usually start arriving a day or two after the DMARC record is published.
What to Look For
- Authorized senders failing — If Mailnaptic’s IPs show SPF or DKIM failures, your DNS records may be misconfigured.
- Unknown IPs passing — This could indicate someone else is using your domain. Investigate immediately.
- Unknown IPs failing — This is expected and means DMARC is protecting you from spoofing attempts. As you tighten your policy, these will be quarantined or rejected.
Taking Action
If legitimate senders are failing authentication, add their SPF include to your record or ensure they support DKIM signing. Once all legitimate sources consistently pass, you can confidently move from p=none to p=quarantine and eventually p=reject (see Configuring DMARC Policy).
Tip: Check your DMARC reports weekly during the initial setup period. Once you reach p=reject with consistently passing reports, monthly checks are sufficient.