With a rua= address in your DMARC record, receivers such as Google, Microsoft and Yahoo send a daily XML file. It lists every server that sent mail claiming your domain, how many messages, and whether SPF and DKIM passed and aligned. It's the only way to see mail sent as you that you didn't send.
One record, line by line
| Field | What it tells you |
|---|---|
source_ip | The server that sent the mail. Look it up to see whose it is. |
count | How many messages came from that server in the period. |
disposition | What the receiver did: none, quarantine or reject. |
dkim and spf under policy_evaluated | Pass or fail after alignment. This is what DMARC goes by. |
header_from | The domain in the visible From line. |
auth_results | The raw SPF and DKIM results, with the domain each was checked against. Compare them with header_from to spot alignment problems. |
Sorting the sources
- Yours, passing. Your mail provider's servers, DKIM passing and aligned. Nothing to do.
- Yours, failing. A tool you use (CRM, invoicing, helpdesk, website forms) with DKIM failing or signed with the tool's own domain. Turn on its domain authentication so it signs as you.
- Forwarded. Your own mail passing through a mailing list or a forwarding mailbox. SPF fails because the forwarder's IP isn't yours; DKIM often still passes. Usually nothing to fix.
- Not yours. Servers you don't recognise, often in volume, failing both. That's spoofing, and it's exactly what
p=quarantineandp=rejectstop.
Reading them without XML
Raw XML is manageable for a domain with one or two senders. Past that, use a report processor. Cloudflare's DMARC Management is available on every Cloudflare plan for domains on Cloudflare DNS, and most dedicated DMARC services have a free tier for small volumes. If rua points at a service on another domain, that service has to publish an authorisation record, or receivers may not send reports to it. Our checker tests for that record.
Failure reports (ruf=) carry copies of individual failing messages. Most large receivers don't send them, for privacy reasons, so don't worry if none arrive.
Questions people ask
How soon do reports arrive?
Usually within a day or two of publishing the rua address, once a receiver has seen mail from your domain.
Why do I see Google IP addresses I don't recognise?
If you use Google Workspace, that's your own mail; Google's sending ranges are large. Check DKIM: if it passes aligned with your domain, it's yours.
Related guides
- Moving DMARC from p=none to reject without losing mail The order of steps, how long to wait, and what to look for first.
- How to find your DKIM selector Read it from a message header in a minute, then check the key.
- SPF too many DNS lookups: how to get under 10 Which terms count, how to count nested includes, and five ways to get under 10.
DNS only shows part of the picture. If mail is still landing in spam with every record right, the deliverability audit looks at the rest: blocklists, reputation, bounces, content and the sending setup.