Reading a DMARC report
With a DMARC record you tell recipients what to do with mail that claims to come from your domain, but doesn't pass the check. You can also ask them to send you reports. There you see which servers send mail on behalf of your domain, and whether that mail passes SPF, DKIM and DMARC. This way you find a service you'd forgotten about, and see if someone is misusing your domain. You can read what DMARC is in What is DMARC? Explained in plain language.
Turning on reports: the rua address
You only get reports if your DMARC record contains a report address, after rua=. The default record for a WebOké hosting package is v=DMARC1;p=reject, without a report address. So then you won't get any reports. You can add an address without changing your policy:
v=DMARC1; p=reject; rua=mailto:dmarc@yourdomain.com
In DirectAdmin, click the pencil behind the _dmarc record in DNS Management and enter the address under Aggregate Email (RUA). See Setting up DMARC. In My WebOké, use the DMARC helper on the DNS tab: DNS helpers: MX, SPF, DMARC, CAA and SRV. Which policy (p=) you choose is explained in Creating a DMARC record in DirectAdmin.
There's also ruf=, for failure reports about individual failed emails. These can contain parts of actual mail, and almost no major receiver sends them. Leave ruf empty: you only need the aggregate reports from rua.
dmarc@yourdomain.com, so your regular mail doesn't get buried. Keep an eye on that mailbox: reports also use up your storage.What you receive
A report is an email with an attachment: an XML file, usually packed as .gz or .zip. The name tells you who sent it, about which domain and for which period, for example google.com!yourdomain.com!1793923200!1794009599.xml.gz. The numbers are timestamps in seconds since 1970. No mail content is included: only, per sending server, how many emails there were and how the checks turned out.
Reading one row
Each <record> block covers one sending IP address:
<row>
<source_ip>198.51.100.40</source_ip>
<count>1250</count>
<policy_evaluated>
<disposition>none</disposition>
<dkim>fail</dkim>
<spf>fail</spf>
</policy_evaluated>
</row>
<identifiers>
<header_from>yourdomain.com</header_from>
</identifiers>
<auth_results>
<dkim><domain>newsletterservice.example</domain><result>pass</result></dkim>
<spf><domain>bounce.newsletterservice.example</domain><result>pass</result></spf>
</auth_results>
| Part | Meaning |
|---|---|
source_ip | The IP address of the server that delivered the email. |
count | How many emails from this IP address had this outcome. |
disposition | What the recipient did: pass or none (delivered), quarantine (spam folder) or reject (rejected). |
dkim and spf under policy_evaluated | The DMARC outcome: did DKIM or SPF pass for a domain that matches your From address (aligned)? |
header_from | The domain in the From address of the email. |
auth_results | The raw outcome of SPF and DKIM, with the domain it applied to. |
Note the difference between auth_results and policy_evaluated. In the example, both DKIM and SPF pass, but for the domain of the newsletter service. That domain doesn't match yourdomain.com, so DMARC fails. With p=reject, these 1250 emails get rejected.
Finding a forgotten service
- Look at
policy_evaluatedfor each row. Ifdkimorspfshowspass, then that source is fine. - Do both fail? Check
auth_resultsto see which domain is listed. Do you recognize a service of your own, such as your accounting software, webshop or newsletter service? Then enable DKIM with your own domain for that service, and add the service to your SPF record if needed. See Adding or changing an SPF record in DirectAdmin and Setting up DKIM when your DNS is hosted elsewhere. - Not a domain you recognize? Look up who owns the IP address, for example with a whois lookup. An unknown IP address where everything fails is usually someone misusing your domain. That's exactly what your DMARC policy protects you against.
Do you see an unknown IP address where SPF fails, but DKIM passes for your own domain? That's usually mail from you that someone has forwarded. DMARC then passes via DKIM, and you don't need to do anything.
Making reports readable
You can open a single report in a browser or a program that displays XML. If you receive a lot, there are report services (some free) and open source programs that collect the reports and turn them into overviews. Keep in mind that such a service then sees which servers send mail on behalf of your domain. Choose one you trust and that complies with the GDPR.
Is the report address on a different domain than your own, for example with a report service? Then that other domain must give permission with a special record, such as yourdomain.com._report._dmarc.reportservice.example. Without that record, recipients won't send reports to that address. A report service usually arranges that record itself. Background: RFC 9990, chapter 4.