DMARC Telemetry Guide
How to Read DMARC Aggregate XML Reports: Telemetry Guide
Aggregate reports (RUA) provide periodic feedback from receiving mail servers worldwide. They allow domain owners to audit authentication results and discover shadow email senders that are not documented in application inventories.
1. Structure of an RFC 7489 XML Report
Reports include the reporting organization (Google, Yahoo, Enterprise gateways), reporting window timestamp, published policy, sending IP address, message count, and granular disposition outcomes for SPF and DKIM authentication. They provide macro aggregate telemetry rather than private message bodies.
2. How to Triage an Unknown Sending Source
Rank sources by volume and consistency. High-volume failures typically indicate a legitimate business service (like an ERP, ticketing system, or billing provider) that needs proper SPF include or DKIM selector setup. Sporadic single-digit failures from overseas IPs are usually background spoofing noise.
3. When Telemetry Supports Enforcement
You are ready to advance your policy to p=reject when all legitimate volume demonstrates 99%+ alignment across multiple billing cycles. Maintain continuous reporting even after enforcement to catch newly onboarded SaaS tools before they suffer delivery drops.
Frequently Asked Questions (DMARC Aggregate Reports)
What is a DMARC aggregate report (RUA)?
A DMARC aggregate report (RFC 7489 RUA) is an XML feedback file generated daily by receiving email providers (Google, Microsoft, Yahoo) sent to the rua address in your DMARC record. It summarizes all sending servers using your domain, total message volume, and SPF/DKIM alignment outcomes.
Why are DMARC aggregate reports sent as raw XML or Gzip files?
The RFC 7489 specification defines aggregate feedback in machine-readable XML format, typically compressed (.xml.gz or .zip), to transmit massive volumes of forensic data efficiently across the Internet. Automated parsers decompress and convert this raw data into actionable dashboards.
How do I identify unauthorized spoofers in a DMARC report?
Look for source IP addresses belonging to residential ISPs, unknown hosting facilities, or unfamiliar countries where both SPF and DKIM report 'fail', while the visible From domain matches your brand. These indicate spoofing or phishing attempts attempting to forge your identity.
Can I read DMARC reports without paid software?
Yes, you can manually decompress .xml.gz files and view the XML tree, or use DmarcLock's built-in free report ingestion parser to automatically extract ESP providers, message counts, and pass rates without expensive enterprise subscriptions.
DmarcLock automatically ingests and visualizes complex RFC 7489 XML aggregate reports. Explore the product workflow or run a free DMARC record scan.