DMARC Reports

The checks on the Domains page confirm that your DMARC record is published and well formed. They cannot tell you what happens to real mail. DMARC aggregate reports can: every day, receivers such as Google and Microsoft tell you how many messages they saw claiming to be from your domain, which servers sent them, and whether each passed.

Point those reports at Emailens and each monitored domain shows:

• the share of reported mail that passes DMARC
• how many messages failed
• the policy receivers currently see
• every sending IP, with failing sources listed first

This is the evidence you need before moving a domain from p=none to p=quarantine or p=reject.

Before you start

You need:

• a domain added under Dashboard > Domains
• access to that domain's DNS

You do not need to change your MX records, and nothing about how your mail is sent or received changes. Reports are separate messages that receivers send to an address you name.

Step 1: copy your report address

1. Open Dashboard > Domains.
2. Expand the domain's card.
3. In the DMARC reports section, copy the tag. It looks like this:

rua=mailto:inbox+dmarc.srmb6xmmxbew.0b289a027516@try.emailens.dev

Each monitored domain has its own address. Use the one shown on that domain's card: an address copied from a different domain will be ignored, because Emailens drops any report that is not about the domain the address belongs to.

Step 2: add it to your DMARC record

Your DMARC record is a single TXT record at _dmarc.yourdomain.com. What you do depends on what is there now.

You have no DMARC record

Create one that only monitors. p=none asks receivers to report without changing how they treat your mail:

v=DMARC1; p=none; rua=mailto:inbox+dmarc.YOUR-ADDRESS@try.emailens.dev

You have a record with no rua tag

Add the tag to the end. Keep everything that is already there, including your policy:

Before   v=DMARC1; p=quarantine; adkim=r; aspf=r
After    v=DMARC1; p=quarantine; adkim=r; aspf=r; rua=mailto:inbox+dmarc.YOUR-ADDRESS@try.emailens.dev

You already have a rua tag

A record can have only one rua tag, but that tag can list several addresses. Append the Emailens address after a comma, and keep your existing one so that mailbox or service keeps receiving reports:

Before   v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com
After    v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com,mailto:inbox+dmarc.YOUR-ADDRESS@try.emailens.dev

Each address needs its own mailto: prefix. Do not add a second rua= and do not create a second DMARC record: a domain with two DMARC records has no valid DMARC policy at all.

Where to enter it

The record is the same everywhere. Only the field names differ.

Most DNS hosts append your domain to the name automatically, so you enter _dmarc, not _dmarc.yourdomain.com. If your host asks for the full name instead, enter it once. A record that ends up at _dmarc.yourdomain.com.yourdomain.com is the most common reason reports never arrive.

Edit the existing record rather than adding a new one whenever a DMARC record is already present.

Step 3: check the record

Confirm the record is published the way you intended:

dig +short TXT _dmarc.yourdomain.com

On Windows:

nslookup -type=TXT _dmarc.yourdomain.com

You should see exactly one record, starting with v=DMARC1, containing the Emailens address. Then press the re-scan button on the domain's card in Emailens: the DMARC check re-reads the record and will flag a malformed tag or a duplicate record.

When reports arrive

Receivers send aggregate reports about once a day, each covering the previous day. Expect the first one within a day or two of publishing the record.

Two things decide whether you get any at all:

• Your domain has to be sending mail. A report describes messages a receiver actually saw. A domain that sent nothing to Gmail yesterday gets no report from Google today.
• Not every receiver reports. Google, Microsoft and Yahoo do. Many smaller providers do not, so the totals describe the mail that reporting receivers saw, not all of your mail.

Until the first report lands, the section reads No reports received yet.

Reading the summary

The section summarises the last 30 days of reports.

Below it, the source table lists each sending IP with its message count and its pass rate overall, for DKIM, and for SPF. Sources with failing mail are listed first.

"Aligned" is the part that surprises people. A message can carry a valid DKIM signature and still fail DMARC, because the signature belongs to your email provider's domain rather than yours. DMARC only counts a result when the domain that passed matches the domain in the From header.

What to do with a failing source

Every failing source is one of two things.

A service you use that is not set up for your domain. A CRM, a helpdesk, an invoicing tool or a forgotten server sending as you. Mail from it shows SPF or DKIM passing for the provider's own domain but not for yours. The fix is in that service's settings: enable custom-domain DKIM signing, and where it offers one, a custom return-path (bounce) domain so SPF aligns too. Re-check after a day or two and the source should move to 100%.

Someone else sending as your domain. An IP you do not recognise, failing both DKIM and SPF, usually with a small and irregular message count. You cannot fix this source. You stop it by tightening your policy, which tells receivers to quarantine or reject exactly this mail.

Forwarded mail also appears as a low-volume failure: a mailing list or a forwarding address re-sends your message from its own server, which breaks SPF and sometimes DKIM. A handful of these is normal and is not a reason to hold back.

Tightening your policy

Reports are what make this safe. A sensible path:

1. Run at p=none until every service you rely on shows as passing.
2. Move to p=quarantine. Failing mail goes to spam instead of the inbox.
3. Watch the reports for a couple of weeks. Check that Published policy shows quarantine and that no legitimate source has started failing.
4. Move to p=reject when the only failures left are sources you do not recognise.

To go more gradually, add pct=25 to apply the policy to a quarter of failing mail, then raise it.

Subdomains

Reports for subdomains are accepted on the parent domain's address. If you monitor yourdomain.com, reports about mail.yourdomain.com are counted under it.

A subdomain with its own DMARC record at _dmarc.mail.yourdomain.com does not inherit the parent's rua. Add the same Emailens address to that record as well.

Troubleshooting

No reports after three days

• Run the dig command above. If nothing comes back, the record is at the wrong name or has not been saved.
• Check for two DMARC records. Receivers ignore both.
• Check the tag: one rua=, each address prefixed with mailto:, addresses separated by a comma, no line break inside the address.
• Confirm the domain actually sent mail to Gmail or Outlook addresses in the last few days.
• Confirm you used the address from this domain's card and not another domain's.

_dmarc is a CNAME, not a TXT record

Your DMARC record is managed by another service, such as your DNS host's DMARC product or a deliverability provider. You cannot edit the record in DNS. Add the Emailens address as an extra reporting address in that service's settings instead.

Your existing mailbox stopped receiving reports

The original address was replaced rather than appended. Put it back in the same rua tag, separated by a comma.

The re-scan flags the DMARC record

Expand the DMARC check on the card. It names the problem, most often a duplicate record or a missing semicolon between tags.

What Emailens stores

Aggregate reports contain counts and server addresses. They do not contain message content, subject lines, or recipient addresses. From each report Emailens keeps the reporting organisation, the period covered, the published policy, and for each sending IP: the message count, the DKIM and SPF results, the action the receiver took, and the From domain. The report email itself is not kept.

Forensic reports (the ruf tag) are not supported. They can contain parts of real messages, and few receivers send them.

Stopping

Remove the Emailens address from your record's rua tag. Receivers stop sending within a day. Removing the domain from Emailens deletes its stored reports.