DMARC Reports Page Guide

DMARC Aggregate Reports

The DMARC Reports page shows aggregate reports sent by email receivers (Google, Microsoft, Yahoo, and others) that tell you how your email authentication is performing. These reports arrive daily and contain statistical summaries of all email sent using your domain.

Domain Selector

Use the domain filter at the top to select which domain's reports to view. If you manage multiple domains, this lets you switch between them without leaving the page.

Date Range Filter

Filter reports by date range to focus on a specific time period. Common selections include last 7 days, last 30 days, or a custom range. Useful for investigating incidents or tracking improvements over time.

Summary Cards

Four cards at the top provide high-level metrics for the selected period:

Card	What It Shows
Total Reports	Number of aggregate reports received from all reporters
Total Messages	Total email messages covered by those reports
Pass Rate — Legitimate Mail	Of the messages that were actually delivered, the percentage that authenticated (SPF or DKIM aligned). Mail your policy blocked and forwarded copies are excluded and counted separately — your protection working must not read as your domain failing. Shows “—” below 10 delivered messages, where a percentage would be noise.
Blocked	Unauthenticated mail your DMARC policy stopped (quarantined or rejected), with no forwarding explanation — spoofing attempts and misconfigured senders.
Forwarded	Copies relayed by auto-forwarding or a mailing list. Forwarding breaks SPF and usually DKIM, so these cannot authenticate at the final destination. Normal, and not a fault in your setup.
Unauthenticated delivered	Mail that failed DMARC and was delivered anyway, with no forwarding explanation. This is the only bucket that indicates a real problem to fix.
Reporters	Number of distinct organisations that sent reports (e.g., Google, Microsoft)

Why a blocked spoof does not lower your pass rate

A DMARC aggregate report counts every message that claimed to be from your domain — including forgeries. If the pass rate were measured over all of that, then every spoof your policy successfully blocked would push the number down, and a domain would look worse the better it was protected. The pass rate on this page is measured over delivered mail only, so blocking works in your favour and the “Blocked” column is the evidence of it.

Reports Table

The main table lists individual aggregate reports with columns for the reporting organisation, date range covered, total message count, and pass/fail rates. Click a report row to drill into its detailed data.

Source Analysis

Within each report, you can see which IP addresses and email services sent email on your behalf and their authentication results (SPF pass/fail, DKIM pass/fail, DMARC disposition). This is the raw data that drives the SPF Management Decision Queue.

Report Details

Clicking into an individual report shows the full breakdown: every sending IP, the number of messages from each, their SPF and DKIM results, the DMARC policy applied, and the disposition (none, quarantine, or reject) that the receiver took.

Forensic Reports

If forensic (RUF) reports have been received for this domain, a banner links to the forensic reports view. Forensic reports provide details on individual email failures rather than statistical summaries.