Understanding DMARC Reports: A Practical Guide

DMARC reports are the foundation of email authentication monitoring. They provide crucial insights into who is sending email on behalf of your domain, whether those emails are passing authentication checks, and where potential threats or misconfigurations exist. Understanding how to read and act on these reports is essential for maintaining email security.

This comprehensive guide will walk you through everything you need to know about DMARC reports, from basic structure to advanced analysis techniques that can help you identify threats and optimize your email authentication.

The Two Types of DMARC Reports

DMARC actually generates two distinct types of reports, each serving a different purpose in your email security strategy:

Anatomy of an Aggregate Report

Aggregate reports are XML files that contain structured data about email authentication results. Let's break down the key components:

1. Report Metadata

<report_metadata>
  <org_name>google.com</org_name>
  <email>noreply-dmarc-support@google.com</email>
  <report_id>12345678901234567890</report_id>
  <date_range>
    <begin>1672531200</begin>
    <end>1672617599</end>
  </date_range>
</report_metadata>

This section identifies who sent the report (the receiving mail server organization), when the report covers, and a unique identifier for tracking.

2. Policy Published

<policy_published>
  <domain>yourdomain.com</domain>
  <adkim>r</adkim>
  <aspf>r</aspf>
  <p>quarantine</p>
  <sp>quarantine</sp>
  <pct>100</pct>
</policy_published>

This shows the DMARC policy that was in effect during the reporting period. Key fields:

• p: Policy for the domain (none, quarantine, or reject)
• sp: Policy for subdomains
• adkim: DKIM alignment mode (r=relaxed, s=strict)
• aspf: SPF alignment mode (r=relaxed, s=strict)
• pct: Percentage of email to which policy applies

3. Record Entries (The Important Part)

<record>
  <row>
    <source_ip>209.85.220.69</source_ip>
    <count>1547</count>
    <policy_evaluated>
      <disposition>none</disposition>
      <dkim>pass</dkim>
      <spf>pass</spf>
    </policy_evaluated>
  </row>
  <identifiers>
    <header_from>yourdomain.com</header_from>
  </identifiers>
  <auth_results>
    <dkim>
      <domain>yourdomain.com</domain>
      <result>pass</result>
    </dkim>
    <spf>
      <domain>yourdomain.com</domain>
      <result>pass</result>
    </spf>
  </auth_results>
</record>

Each record entry represents a unique combination of sending IP, authentication results, and volume. This is where the actionable intelligence lives.

Reading and Interpreting Report Data

Understanding what the numbers mean is critical for making informed decisions about your email security posture.

Authentication Results Matrix

Common Scenarios and What They Mean

Advanced Analysis Techniques

1. Identify Unknown Senders

Look for source IPs you don't recognize with significant volume. Use reverse DNS lookup and WHOIS to identify:

• Company-owned mail servers you forgot about
• Third-party services sending on your behalf (marketing, HR systems, etc.)
• Forwarding services that break SPF
• Potential spoofing attempts

2. Track Volume Trends Over Time

Monitor how volume changes for each source:

• Gradual increase: Normal business growth
• Sudden spike: Marketing campaign, system change, or potential attack
• Gradual decrease: Service migration or reduced usage
• Intermittent volume: Scheduled jobs, newsletter campaigns

3. Calculate Pass Rates

Target metrics:

• 90%+ pass rate: Excellent - ready for enforcement
• 70-90% pass rate: Good, but investigate failures before quarantine
• Below 70%: Significant issues - stay in monitoring mode

4. Identify Alignment Issues

Pay attention to the difference between authentication results and alignment:

Tools for DMARC Report Analysis

Manually parsing XML files is tedious and error-prone. Use specialized tools for efficient analysis:

Report Analysis Workflow

Establish a regular cadence for reviewing reports. Here's a recommended workflow:

Common Pitfalls to Avoid

Conclusion

DMARC reports are your window into email authentication for your domain. By understanding how to read and interpret these reports, you can:

• Identify all legitimate email sources and ensure they're properly authenticated
• Detect potential spoofing and phishing attempts before they damage your reputation
• Make informed decisions about policy progression from monitoring to enforcement
• Optimize your email authentication configuration for maximum deliverability

The key is consistency. Set up a regular review process, use tools to automate analysis where possible, and always investigate before blocking. With proper report analysis, DMARC becomes a powerful shield protecting your domain's email reputation.