How to read DMARC aggregate reports

What's in a report

• Who sent it: the receiving provider, such as Google, Microsoft or Yahoo, and the date range
• Your published policy at the time
• One row per sending IP address: how many messages, whether SPF and DKIM passed, and whether they aligned with your domain
• What the receiver did: delivered, quarantined or rejected

Sorting the rows

1. 1

   Name each sending IP

   Reverse DNS and the DKIM signing domain usually reveal the service: protection.outlook.com is Microsoft 365, google.com is Google Workspace, mcsv.net is Mailchimp, amazonses.com is Amazon SES.

2. 2

   Mark your real senders

   Your mail platform plus every tool that sends as you: newsletters, CRM, invoicing, helpdesk, website forms.

3. 3

   Fix real senders that fail

   A legitimate service failing DMARC usually needs DKIM set up for your domain in that service's settings.

4. 4

   Look at what's left

   Unknown servers failing both checks are either spoofing or forwarding through mailing lists. That's the mail quarantine and reject will stop.

5. 5

   Tighten when it's clean

   When your real senders pass consistently for a couple of weeks, move to quarantine, then reject.

Why forwarded mail fails

When someone forwards your message or a mailing list re-sends it, the forwarding server isn't in your SPF record, so SPF fails. DKIM usually survives forwarding, which is one reason to sign everything with DKIM before enforcing DMARC.

Doing it with TenantWard

Point your DMARC reports at TenantWard and the Email senders tab does this sorting for you: it names each service, shows what passes and fails, gives the fix for each failing sender, and tells you when it's safe to move to quarantine or reject, with a one-click change you can undo.

Questions

Where should DMARC reports go?

To an address that can process XML reports, not a person's inbox. A busy domain gets dozens of reports a day. A reporting service, like TenantWard's, turns them into a list of senders.

How long until reports arrive?

Most large providers send one report per day, so expect the first within 24 to 48 hours of publishing DMARC.