Home/ Glossary/ DMARC Aggregate Reports (rua)

DMARC Aggregate Reports (rua) (DMARC Aggregate Reports)

Security Glossary - Email Authentication

Definition: DMARC aggregate reports (rua) are XML reports sent by receiving mail servers to the email address specified in your DMARC record's rua tag. They contain statistics about emails sent using your domain, including which servers sent them, whether they passed SPF and DKIM, and what DMARC disposition was applied.

The Importance of DMARC Aggregate Reports

Aggregate reports provide visibility into who is sending email using your domain - both legitimate services and unauthorized senders. Without these reports, you are blind to email spoofing attempts and cannot verify that your authentication is working correctly across all email services.

Reports are typically sent daily by major email providers (Google, Microsoft, Yahoo, etc.). They are XML files that can be difficult to read raw. DMARC reporting services (like Postmark DMARC, DMARC Analyzer, or dmarcian) parse these reports into readable dashboards showing authentication pass/fail rates, sending sources, and trends.

The data from aggregate reports is essential for the DMARC rollout process. They show you which email sources are not yet authenticated, allowing you to fix SPF and DKIM configuration before moving to an enforcing policy. Without this data, advancing to p=quarantine or p=reject is risky.

Testing Your Configuration

Configure the rua tag in your DMARC record to receive aggregate reports: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com. Use a DMARC report analyzer service to parse the XML reports into actionable data. Check reports weekly to monitor authentication health.

See how your site handles DMARC Aggregate Reports

Check DNS Health

DMARC Aggregate Reports FAQ

How do I read DMARC aggregate reports?
Raw reports are XML files that are difficult to read manually. Use a free DMARC report analyzer (like Postmark DMARC or Google's DMARC tools) that parses the XML into readable dashboards. These show which IPs are sending as your domain and whether authentication passes or fails.
How often are aggregate reports sent?
Most email providers send aggregate reports daily. The exact frequency depends on the receiver. Large providers like Google and Microsoft are reliable senders. Smaller providers may not send reports at all.

Related Concepts

Domain-based Message Authentication, Reporting and Conformance DMARC Forensic Reports (ruf) DMARC Policy Types Sender Policy Framework DomainKeys Identified Mail
Disclaimer: DomainOptic provides automated informational scans only. Results do not constitute professional security advice, compliance certification, or a guarantee of security. Always verify findings independently.