DMARC aggregate report
The daily XML summary a receiver sends to a domain's rua address, counting messages by sending IP address with their SPF, DKIM and DMARC results.
What it means
Receivers that support DMARC reporting send one report per domain per reporting period, normally daily. The XML file, usually gzip-compressed and attached to an email, lists the policy the receiver found and rows grouped by source IP address: message count, the disposition applied, the SPF and DKIM domains and results, and whether each aligned.
These reports are the main tool for reaching enforcement. They show every service sending as the domain, legitimate or not, and which ones fail alignment. They contain no message content. The format is now defined by RFC 9990, which replaced the reporting part of RFC 7489.
Raw XML is hard to read at volume; a parser or reporting service turns it into a list of sources.
Example
<record><row><source_ip>192.0.2.10</source_ip><count>412</count><policy_evaluated><disposition>none</disposition><dkim>pass</dkim><spf>fail</spf></policy_evaluated></row>...</record>Related terms
On this site
Sources
What this definition rests on. The wording is ours; the facts are theirs.
- RFC 9990: DMARC Aggregate Reporting, section 3.1rfc-editor.org
- RFC 9990: DMARC Aggregate Reporting, section 3.5rfc-editor.org
- Google Workspace Admin Help: Set up DMARCknowledge.workspace.google.com
All 432 terms in the glossaryThe wiki: blocklists and bounce codes