RUA (Aggregate Report)
A daily XML summary report sent by mail receivers to a DMARC-publishing domain, listing every IP that sent under the domain and how each authenticated.
Definition
A DMARC aggregate report — also called a RUA report, after the rua= tag in the DMARC record that requests them — is a daily XML summary sent by mail receivers (Gmail, Outlook, Yahoo, and others) to a domain owner. The report lists every source IP that sent mail under the domain in the previous 24 hours, the volume from each, the SPF and DKIM authentication results, alignment results, and the disposition the receiver applied. Aggregate reports are the feedback channel that turns DMARC from a static policy into an actionable monitoring tool.
How it works
A receiver sending an aggregate report compresses an XML file with one <record> entry per source IP, attaches it to an email, and sends it to every address listed in the rua= tag of the DMARC record. The XML includes the originating IP, the message count, the disposition (none/quarantine/reject), the SPF and DKIM results, and the alignment result for each protocol. Reports cover the previous calendar day in UTC and arrive the following morning.
The volume of aggregate reports for an active domain is high — Gmail alone can send daily reports for any domain it sees significant traffic from. Reports are designed to be parsed by software, not read by humans: a single domain might receive 20–100 reports per day from different receivers. DMARC monitoring services (including DMARC Busta) ingest and aggregate these reports to surface findings — new sending sources, alignment failures, volume spikes — that a human can act on.
Example
<record>
<row>
<source_ip>192.0.2.42</source_ip>
<count>1247</count>
<policy_evaluated>
<disposition>none</disposition>
<dkim>pass</dkim>
<spf>fail</spf>
</policy_evaluated>
</row>
<identifiers>
<header_from>example.com</header_from>
</identifiers>
</record>This entry says: 1,247 messages came from 192.0.2.42 with header From of example.com. DKIM passed and aligned; SPF failed alignment. The receiver applied no policy disposition (because the domain is at
p=none).Related Terms
Automate your DMARC
DMARC Busta puts SPF, DKIM, and DMARC management on autopilot — across one domain or 10,000.
Start free trial