XML, ZIP or GZIP from the rua address of your DMARC record, up to 1 MB.
The example is a made-up report for example.com with addresses reserved for documentation.
How the analysis works
Without an account, the report is read in memory and not stored. We parse the XML (RFC 9990; the older RFC 7489 format works too), group the records by sending IP address and count the messages that passed DMARC with aligned SPF or aligned DKIM, as the receiver evaluated them.
A failing source is classified by what did pass. A valid DKIM signature of another domain usually means a service that signs with its own domain; SPF passing for another domain means a service that uses its own bounce address. When nothing passed, the mail was either spoofed or sent by a server nobody set up.
A service is named only from verified data: a DKIM signature the receiver reported as valid, or a host name whose reverse and forward DNS agree (checked for the 20 busiest sources). Otherwise the IP address and the signing domain are shown as they are.
Limitations
- One report covers one receiver and usually one day. Base policy decisions on several weeks of reports from several receivers.
- Receivers report what they saw; counts differ between receivers, and some send no reports at all.
- Uploads without an account are limited to 1 MB (5 MB of XML) and 5,000 records. Signed-in users can save reports of their verified domains.
Frequently asked questions
Where do I get DMARC aggregate reports?
Add a rua tag to your DMARC record, for example rua=mailto:dmarc@yourdomain. Receivers then send a daily XML report, usually zipped or gzipped, to that address.
Is it safe to upload a report?
Reports contain IP addresses of sending servers, domains and message counts — no message content and no recipient addresses. Without an account the file is analyzed in memory and discarded; nothing from it is stored or logged.
Why does my own mail fail DMARC?
Usually because a service sends on your behalf without your domain in its DKIM signature or bounce address. Turn on custom DKIM (and, if the service offers it, a custom return-path) in that service.
When can I move to p=quarantine or p=reject?
When reports over several weeks show that every legitimate source passes DMARC. The unauthenticated sources that remain are then spoofing, which the stricter policy stops.