Things to do after collecting your first DMARC data

Tags: dmarc, dmarcreport
Published: 2021-09-06 07:53:46

After you have added a DMARC record to your DNS, you’ll start receiving data pertaining to your email deliverability, domain usage, and domain security. Wondering what to do with it? Well, we’ll tell you just that! But first, you need to understand what a DMARC report is.

What is a DMARC report?

DMARC reports are authentication results from your domain. It acts as a feedback mechanism that helps the domain owner track email security and deliverability issues. The report also intimates the domain owner of malicious sources and protocol errors. 

DMARC reports are a goldmine of valuable information. This data can be used to strengthen a domain and take action against malicious sources while minimizing errors and deliverability issues. However, DMARC reports can be confusing to the average user due to their highly technical nature. 

The reports are of two types: DMARC Aggregate (RUA) Reports and DMARC Forensic (RUF) Reports. They are sent in XML format to the domain owner’s email address periodically.

Let’s look at an example of a DMARC sample report and try to understand the different aspects it consists of.


ISP/ Email Service Provider

<?xml version=”1.0″ encoding=”UTF-8″ ?>
<feedback>
  <report_metadata>
    <org_name>google.com</org_name>
    <email>noreply-dmarc-support@google.com</email>
   <extra_contact_info>http://google.com/dmarc/supp

Report ID

 <report_id>8293631894893125362</report_id>

Date Range

<date_range>
      <begin>1234573120</begin>
      <end>1234453590</end>
    </date_range>

DMARC record 

<policy_published>
    <domain>yourdomain.com</domain>
    <adkim>r</adkim>
    <aspf>r</aspf>
    <p>none</p>
    <sp>none</sp>
    <pct>100</pct>
  </policy_published>

IP Address

<source_ip>302.0.214.308</source_ip>

Authentication Overview

<policy_evaluated>
        <disposition>none</disposition>
        <dkim>fail</dkim>
        <spf>pass</spf>
      </policy_evaluated>

From:Domain

 <header_from>yourdomain.com</header_from>

DKIM authentication report

<dkim>
        <domain>yourdomain.com</domain>
        <result>fail</result>
        <human_result></human_result>
      </dkim>

SPF authentication report

<spf>
        <domain>yourdomain.com</domain>
        <result>pass</result>
      </spf>

Here are a few things that you should do after you receive your DMARC report:

Monitor your sending sources

DMARC reports will present a list of all the domains and IP addresses you use to send emails. It gives you insight into your various devices and lets you know if an unauthorized IP is trying to send an email to a recipient on your behalf.

Check Email Authentication

DMARC reports will show you if your mail sender fails SPF, DKIM, or DMARC authentication standards.

Regulate the usage of your Domain
DMARC reports help you determine if there are any unauthorized senders using your domain to send emails to unsuspecting recipients.


Regularly analyzing your DMARC reports helps you strengthen your domain and improve its security rating. In addition, your brand reputation among your customers increases when your mailing systems are more secure and safer than others.

Original Source: https://www.ebaumsworld.com/blogs/things-to-do-after-collecting-your-first-dmarc-data/86978498/