DMARC failure report
A per-message report a receiver may send to a domain's ruf address when a message fails DMARC, often with its headers or full content.
What it means
Failure reports, long called forensic reports, are sent shortly after a failure, so they surface problems faster than daily aggregates. They use the Abuse Reporting Format as extended for authentication failures by RFC 6591, with DMARC additions such as an Identity-Alignment field naming the mechanisms that failed to align. RFC 9991 now defines them.
Because they can contain message headers or bodies, they may include personal data. RFC 9991 asks owners to weigh that before requesting them and receivers to redact what their privacy policy requires. Some receivers, Gmail among them, send none.
Request them with ruf= and tune when they are sent with fo=.
Related terms
Sources
What this definition rests on. The wording is ours; the facts are theirs.
- RFC 9991: DMARC Failure Reporting, section 2rfc-editor.org
- RFC 9991: DMARC Failure Reporting, section 4rfc-editor.org
- RFC 6591: Authentication Failure Reporting Using the Abuse Reporting Formatrfc-editor.org
- Google Workspace Admin Help: Set up DMARCknowledge.workspace.google.com
All 432 terms in the glossaryThe wiki: blocklists and bounce codes