Recommended Free Tools
A DMARC aggregate report shows what a receiving mail system observed about messages claiming to come from your domain. Read it in layers: identify the reporting receiver and time period, check the policy snapshot, then inspect each source’s volume, DMARC alignment results, raw SPF/DKIM results, and any policy override. The key distinction is that an SPF or DKIM pass is not automatically a DMARC-aligned pass.
RUA is the DMARC tag used to request aggregate feedback. RFC 9989 says receivers must not generate aggregate feedback reports for a domain when its DMARC record does not include rua (RFC 9989).
As an Amazon Associate I earn from qualifying purchases.
How to open a DMARC XML report
RUA reports are machine-readable XML. Attachments may arrive as plain XML or gzip-compressed XML; RFC 9990 says reports must be XML and should be gzip compressed. If you inspect a file manually, decompress it first when necessary and open it with a trusted XML viewer or parser. For repeated reports or large volumes, a reporting system can make grouping and comparison easier.
There is no universal delivery cadence. Each report identifies its own reporting period, and delivery behavior varies by receiver. Avoid treating one report as a complete or real-time view of all mail activity.
#1 Best Overall
Read the report in this order
- Identify who reported and when. In
report_metadata, noteorg_name,report_id, anddate_range. These identify the reporting organization, report, and observation period. - Check the policy snapshot. In
policy_published, checkdomainand the recorded policy settings, includingp,sp, andnpwhen present. This is what the receiver recorded for the report; do not assume it necessarily matches the domain’s current DNS configuration. A policy change during the reporting period can also affect interpretation. - Scan each message record. In
record/row, usesource_ipandcountto identify the connecting IP and the number of messages represented by that record. Look across multiple rows and periods before deciding whether a pattern is persistent. - Read the DMARC evaluation. Check
policy_evaluated/disposition,spf, anddkim. The SPF and DKIM values in this section report alignment results for DMARC; they are not simply the raw authentication outcomes. - Compare raw authentication results. Under
auth_results, check SPF’sdomainandresult, and DKIM’sdomain,selector, andresult. Compare the authenticated domains with the domain in the visible From address and the applicable alignment mode. - Check for an override explanation. If the receiver’s recorded disposition differs from the published policy you expected, inspect any
policy_evaluated/reason. It can provide context for the receiver’s action, but it does not establish that a source is trustworthy. - Classify before changing anything. Map recognized sending services, investigate unfamiliar sources, and fix alignment for legitimate mail before changing your domain’s DMARC policy.
RFC 9990 defines the aggregate report’s XML fields and record structure (RFC 9990).
What the important fields tell you
| Field | What it records | How to use it |
|---|---|---|
report_metadata/org_name |
The reporting organization | Identify the receiver that compiled the report. |
report_metadata/date_range |
The start and end of the reporting period | Use the period when comparing reports; receivers need not deliver reports on the same schedule. |
policy_published/domain |
The DMARC policy domain represented in the report | Confirm that the report concerns the domain you expect. |
policy_published/p, sp, np |
Published policy information recorded by the receiver | Interpret the report’s policy snapshot; check DNS separately before assuming it is the current configuration. |
record/row/source_ip |
The connecting IP address | Use it as an investigation clue, not an identity or abuse verdict by itself. |
record/row/count |
The message count for the evaluated record | Use volume to prioritize review. An unfamiliar source or large count warrants investigation but does not prove abuse. |
policy_evaluated/disposition |
The DMARC disposition recorded for the messages | Interpret it alongside the policy snapshot and any override reason. |
policy_evaluated/spf, dkim |
Whether SPF and DKIM identities aligned for DMARC | Do not confuse these alignment results with raw SPF or DKIM authentication results. |
auth_results/spf/domain, result |
The SPF-checked domain and raw SPF result | A raw SPF pass can still fail DMARC alignment. |
auth_results/dkim/domain, selector, result |
The DKIM signing domain, selector, and raw signature result | A valid signature can come from a domain that does not align with the visible From domain. |
policy_evaluated/reason |
A reason associated with a policy override | Use it to understand a receiver’s handling; it is context, not proof that a source is safe. |
The XML elements and override reasons are specified in RFC 9990; Microsoft Learn also provides an operational field guide for interpreting reports (Set up DMARC to validate email in Microsoft 365).
Why SPF or DKIM can pass while DMARC alignment fails
SPF and DKIM authenticate identities associated with a message. DMARC additionally checks whether an authenticated identity aligns with the domain shown to the recipient in the visible From address. Consequently, a raw SPF or DKIM result of pass can coexist with a failed alignment result in policy_evaluated.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Known sender: SPF passes, alignment fails
A sending service may use a MAIL FROM domain that does not align with the visible From domain. Check the service’s configuration for a custom or aligned MAIL FROM domain, or configure aligned DKIM if supported.
Known sender: DKIM passes, alignment fails
The message may have a valid signature using the service’s own signing domain rather than your domain. Check whether the provider supports a custom DKIM signing domain and configure it to align with the visible From domain where possible.
Unknown source: volume is high and both alignments fail
This pattern may indicate spoofing, but a report row alone does not prove malicious intent. Correlate the source IP, message volume, and timing with your known sending services and other available evidence before drawing a conclusion.
Forwarding or mailing-list traffic fails
Forwarding can disrupt SPF because the message reaches the next receiver from a different system. Mailing-list changes to message content can invalidate a DKIM signature. Consider the full delivery path and any reported override reason rather than treating every failure as an unauthorized sender.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →These common alignment and delivery patterns are discussed in Microsoft’s DMARC guidance (Microsoft Learn).
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What disposition and override reasons mean
policy_evaluated/disposition records the action represented in the report. Read it with the policy snapshot and any reason field. A disposition of none does not, by itself, mean that the message passed SPF, DKIM, or DMARC; consult the separate alignment and authentication results.
RFC 9990 defines override reasons including local_policy, mailing_list, trusted_forwarder, other, and policy_test_mode. These can explain why a receiver’s handling differs from the policy you expected, but they describe the receiver’s stated rationale rather than independently validating the source.
How to choose between manual review and an analysis service
Manual XML review can be enough when you have a manageable number of reports and need to investigate a particular record. A reporting or analysis service may be more practical when you need to compare recurring sources over time. Compare workflows on these points:
- File handling: Can it ingest the XML and gzip-compressed XML attachments your receivers send?
- Preserved context: Does it retain report periods, reporting organizations, source counts, raw SPF/DKIM results, alignment results, dispositions, and override reasons?
- Sender grouping: Can it help you recognize recurring legitimate services and distinguish them from unfamiliar sources without treating an IP as a definitive identity?
- Data handling: Are you comfortable uploading email authentication metadata to that service, and do its handling terms fit your organization’s requirements?
Regardless of the inspection method, base configuration changes on recurring evidence and a verified inventory of legitimate senders, not one unexplained row.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
