RUF forensic reports are per-message failure reports sent to the address in your DMARC record's ruf tag when a message fails authentication. Unlike aggregate reports, which summarize counts, a forensic report captures details of an individual failing message, following the AFRF format defined in RFC 6591. They help you diagnose exactly why specific messages fail and spot active abuse.
How RUF differs from RUA
- RUA reports are daily summaries grouped by sending source. RUF reports are generated per failing message, close to real time.
- RUA contains counts and results only. RUF can contain message headers and sometimes parts of the body.
- RUA is sent by nearly all major receivers. RUF is sent by far fewer providers because of privacy concerns.
- RUA is your main tool for reaching enforcement. RUF is a diagnostic and abuse-detection supplement.
The ruf tag
ruf=mailto:ruf@example.com; fo=1 The fo tag controls when reports are generated. fo=1 requests a report whenever any authentication check fails to align.
The fo tag options
- fo=0: generate a report only if both SPF and DKIM fail to produce an aligned pass. This is the default.
- fo=1: generate a report if either SPF or DKIM fails to align. The most useful setting for diagnostics.
- fo=d: generate a report if DKIM fails, regardless of alignment.
- fo=s: generate a report if SPF fails, regardless of alignment.
Privacy considerations
Because forensic reports can include headers and message content, they may carry personal data belonging to your recipients or senders. This is why most large mailbox providers do not send RUF at all, and why you must handle any reports you do receive with care. If your organization is subject to privacy regulation, treat forensic data as sensitive and limit who can access it.
EmailAuth redacts personally identifiable information in RUF reports before presenting them, so you get the diagnostic value of a failure sample without exposing recipient data. Reports are parsed into a readable view rather than raw AFRF text.
When RUF is useful
Forensic reports earn their place in two situations: diagnosing a stubborn source that keeps failing in your aggregate data, and catching active phishing campaigns that spoof your domain. Seeing the headers of a failing message often reveals the misconfiguration or the attacker's infrastructure immediately. For most day-to-day rollout work, though, RUA reports carry the load, and RUF is the detail layer you turn to when you need it.
Should you enable RUF
Enable RUF if you want failure-level detail and can handle the data responsibly. Expect low volume, since few providers send it. Keep in mind that RUF alone does not get you to enforcement: you still need RUA to inventory sources and confirm alignment. Treat forensic reports as a complement, not a replacement.
Frequently asked questions
What is the difference between RUA and RUF?
RUA reports are daily aggregate summaries of authentication results grouped by sending source. RUF reports are per-message forensic samples of individual failures, defined in RFC 6591, that can include message headers. RUA is your main rollout tool; RUF is a diagnostic supplement.
Why don't I receive forensic reports?
Most major mailbox providers, including Google and Microsoft, do not send RUF reports because of privacy concerns about message content. Even with a valid ruf tag and fo=1, you should expect low or zero volume. Rely on aggregate (RUA) reports for your source inventory.
Are forensic reports a privacy risk?
They can be, because they may contain message headers and body fragments that include personal data. Handle any RUF reports you receive as sensitive, restrict access, and consider redaction. EmailAuth removes personally identifiable information from RUF reports before displaying them.
What does fo=1 mean in a DMARC record?
The fo tag sets when forensic reports are generated. fo=1 requests a report whenever either SPF or DKIM fails to produce an aligned pass, which is the most useful setting for diagnostics. The default, fo=0, only reports when both fail to align.
[ DMARC guide ]
[ Request a demo ]
See EmailAuth in 20 minutes
A live walkthrough of agentic DMARC enforcement on your own domain, with your team approving every change.