DMARC reports: how to read and use them

Once your DMARC record is in place, email providers send you daily reports. Here is what DMARC is, why it matters, and how to read those reports.

What is DMARC?

DMARC (Domain-based Message Authentication, Reporting and Conformance) is an email security standard. It builds on SPF and DKIM to stop others from sending fake emails in your name, and it sends you reports about emails sent from your domain.

Spammers sometimes forge the From address so an email looks like it comes from your business. DMARC checks emails are allowed to be sent on behalf of your domain, and lets you set a policy for what receiving servers do with emails which fail SPF or DKIM: mark them as spam, or reject them.

DKIM and SPF

DKIM (DomainKeys Identified Mail) adds a digital signature to each email, made with a private key linked to your domain. The receiving server, such as Gmail or Outlook, checks it with a public key in your DNS. This proves the email came from an approved sender and was not changed on the way. DKIM also helps build your domain's reputation.

SPF (Sender Policy Framework) is a list in your DNS of the services and IP addresses allowed to send email for your domain. When an email arrives, the receiving server checks the sender is on the list. If not, the email may be flagged or rejected.

Why DMARC helps you

• Protects your business name. It stops others from sending emails pretending to be you. Publishing a DMARC record alone can improve your reputation with email providers.
• Shows how your domain is used. Reports show who sends email in your name, so you can spot anything suspicious.
• Improves deliverability. Finding and fixing authentication problems helps more of your emails reach the inbox.
• Reduces spam complaints. Fake emails in your name are stopped before they reach people.

What a report contains

• The organization which created the report.
• The reporting period, start and end.
• SPF and DKIM results: pass or fail.
• Alignment: whether SPF and DKIM match your sending domain.
• The sending IP address.
• What the receiving server did: accepted, quarantined or rejected.

Why track your reports

• Find and fix authentication problems which could send your emails to spam.
• Make sure every email sent from your domain comes from a source you approved.
• Meet requirements. Google, for example, has required certain senders to use DMARC since February 2024.
• Keep proof. Saved reports show you meet security standards.

A shortened example report

<feedback>
  <report_metadata>
    <org_name>emailprovider.com</org_name>
    <report_id>ff2d7a69-d5a4</report_id>
    <date_range>
      <begin>1705795200</begin>
      <end>1705881600</end>
    </date_range>
  </report_metadata>
  <policy_published>
    <domain>yoursleepbusiness.com</domain>
    <p>none</p>
  </policy_published>
  <source_ip>XXX.XXX.XXX.XXX</source_ip>
  <policy_evaluated>
    <disposition>none</disposition>
    <dkim>pass</dkim>
    <spf>pass</spf>
  </policy_evaluated>
  <header_from>yoursleepbusiness.com</header_from>
</feedback>

How to read it

Option A, by hand:

• org_name and email: the email provider which sent the report.
• report_id: the report's reference number.
• date_range: the start and end of the period, in seconds.
• policy_published: your DMARC record as published in your DNS, including your policy (p=none).
• source_ip: the IP address the emails came from.
• policy_evaluated: the summary, with what was done (disposition) and whether DKIM and SPF passed.
• header_from: the domain in the From field.
• The spf and dkim sections: the detailed results for each check.

Option B, with an AI assistant:

1. Open the email with the report and download the XML attachment.
2. Open it in a plain text editor, such as Notepad or TextEdit.
3. Copy everything.
4. Paste it into an AI assistant, such as ChatGPT or Claude, and ask: "Can you analyze this DMARC report and tell me if any emails failed SPF or DKIM checks?"
5. Read the explanation of the sender, the SPF and DKIM results, the IP address and the action taken.

Keep going

Setting up DMARC is a great first step, and it needs ongoing care:

• Check your reports regularly for anyone sending in your name without permission.
• Fix SPF or DKIM problems quickly, and adjust your policy when needed.
• Keep good habits: a list of parents who said yes, low spam rates and helpful content.