[ Quick answer ]
DMARC aggregate (RUA) reports are XML files that mailbox providers send, usually daily, to the address in your rua= tag. They summarize every IP that sent mail as your domain, how many messages it sent and whether SPF, DKIM and DMARC passed.
Key facts
- ›Sent to the mailto: address in the rua= tag, usually every 24 hours.
- ›Contain counts and results, not message content.
- ›Usually gzip or zip compressed XML.
- ›External report addresses on another domain need an authorization record.
Reviewed 2026-11-02 · EmailAuth research team
RUA aggregate reports are XML summaries that receiving mail providers send to the address in your DMARC record's rua tag, usually once a day. Each report groups messages by sending IP and shows how many passed or failed SPF, DKIM, and DMARC alignment. They are the primary tool for understanding who sends mail as your domain and whether your authentication is set up correctly.
What is inside an aggregate report
- The reporting organization, such as Google or Yahoo, and the date range covered.
- The published DMARC policy the receiver saw for your domain.
- One record per sending IP, with the message count and the source.
- SPF results and whether SPF aligned with your From domain.
- DKIM results and whether the DKIM signature aligned.
- The DMARC disposition applied: none, quarantine, or reject.
How to read the data
For each sending IP, ask two questions: is this a source I recognize, and does it pass DMARC? A recognized source that passes needs no action. A recognized source that fails means SPF or DKIM is misconfigured for that service and you must fix its authentication. An unrecognized source that sends volume is either a service you forgot or an attacker spoofing your domain.
The rua tag
rua=mailto:rua@example.com Add this to your DMARC record so aggregate reports begin flowing. You can list more than one address, comma separated.
Why raw XML is hard to use
Aggregate reports arrive as compressed XML from dozens of providers every day. Reading them by hand does not scale past a handful of messages. EmailAuth ingests RUA reports automatically, resolves IPs to named services, and shows pass and fail trends per source over time, so you can tell at a glance which senders still need SPF or DKIM work before you enforce.
Using RUA to reach enforcement
- 1
1. Collect a baseline
Publish p=none with your rua address and gather two to four weeks of reports.
- 2
2. Identify every source
List each sending IP and match it to a legitimate service or flag it as unknown.
- 3
3. Fix alignment
Authenticate each legitimate source with SPF and DKIM until it passes and aligns.
- 4
4. Enforce
Once legitimate sources pass consistently, move to quarantine and then reject.
What RUA does not show
Aggregate reports contain counts and authentication results, not message content, subjects, or recipients. They tell you how much mail passed or failed from each source, but not the details of a single message. For per-message detail on failures, you need forensic reports (RUF), which are a separate DMARC feature.
Frequently asked questions
How often do DMARC aggregate reports arrive?
Most providers send RUA reports once every 24 hours, which is the default reporting interval. You can request a different interval with the ri tag, but receivers are not required to honor it, so daily is what you should expect.
Do aggregate reports contain email content?
No. RUA reports contain only aggregated metadata: sending IPs, message counts, and SPF, DKIM, and DMARC results. They never include subject lines, message bodies, or recipient addresses. For limited per-message detail you would use forensic (RUF) reports instead.
Why am I not receiving DMARC reports?
The most common causes are a missing or malformed rua tag, a typo in the report address, or DNS not having propagated yet. Confirm your record reads like rua=mailto:rua@example.com and that the mailbox can receive external mail. A free domain scan will confirm the record is valid.
Can I send RUA reports to a domain I do not own?
Yes, but the receiving domain must publish an external destination verification record so providers will send reports there. Report processors like EmailAuth handle this authorization for you when you point rua at their address.
What is a DMARC report?
It is a machine-readable summary from a mailbox provider showing which sources sent mail as your domain and their authentication results.
How do I read DMARC reports?
Open the XML in a DMARC report analyzer. Look for sources with high volume that fail DKIM or SPF alignment: those are either senders you must fix or attackers.
Do DMARC reports contain personal data?
Aggregate reports contain IPs, domains and counts, not message bodies. Forensic (RUF) reports can contain headers or content, which is why few providers send them.
[ DMARC guide ]
[ Request a demo ]
See EmailAuth in 20 minutes
A live walkthrough of agentic DMARC enforcement on your own domain, with your team approving every change.