---

title: "Understanding DMARC Aggregate Reports"
description: "How to read and analyze DMARC aggregate (RUA) reports. Learn what the XML data means and how to use it to reach p=reject."
date: "2026-07-01"

Understanding DMARC Aggregate Reports

A DMARC report analyzer turns raw XML data into actionable intelligence. Without one, the aggregate reports sitting in your inbox are nearly unreadable. This guide explains what the data means, how to interpret it, and how to use it to move your policy from p=none to p=reject.

What Is a DMARC Aggregate Report

When you publish a DMARC record with an rua tag, participating mail receivers send you aggregate reports. These reports are compressed XML files delivered to the address you specify. They arrive daily, one per sending domain, per receiver.

Each report answers three questions:

• Who sent email claiming to be from your domain?
• Did those messages pass SPF and DKIM alignment?
• What did the receiver do with them?

A minimal DMARC DNS record looks like this:

v=DMARC1; p=none; rua=mailto:[email protected]; rua=mailto:[email protected]; aspf=r; adkim=r;

The rua tag accepts multiple comma-separated addresses. If you want reports sent to a third-party address, that domain must publish a DNS record granting permission:

yourdomain.com._report._dmarc.thirdparty.com  IN TXT  "v=DMARC1;"

Anatomy of an Aggregate Report

The XML structure follows RFC 7489. Every file contains a report metadata block, a policy published block, and one or more record blocks.

Report Metadata

<report_metadata>

<org_name>Google Inc.</org_name>
<email>[email protected]</email>
<report_id>12345678901234567890</report_id>
<date_range>
<begin>1751328000</begin>
<end>1751414399</end>
</date_range>
</report_metadata>

org_name identifies the reporting mail receiver. date_range uses Unix timestamps. Convert them to confirm the reporting window aligns with your expectations.

Policy Published

<policy_published>

<domain>yourdomain.com</domain>
<adkim>r</adkim>
<aspf>r</aspf>
<p>none</p>
<sp>none</sp>
<pct>100</pct>
</policy_published>

This block reflects the policy the receiver read from DNS at the time of evaluation. If this does not match your current record, propagation may be delayed or a receiver cached a stale value.

Record Blocks

Each element represents a source IP address and its authentication results.

<record>

<row>
<source_ip>209.85.220.41</source_ip>
<count>4823</count>
<policy_evaluated>
<disposition>none</disposition>
<dkim>pass</dkim>
<spf>pass</spf>
</policy_evaluated>
</row>
<identifiers>
<header_from>yourdomain.com</header_from>
</identifiers>
<auth_results>
<dkim>
<domain>yourdomain.com</domain>
<result>pass</result>
<selector>google</selector>
</dkim>
<spf>
<domain>yourdomain.com</domain>
<result>pass</result>
</spf>
</auth_results>
</record>

The policy_evaluated block shows alignment results. The auth_results block shows raw authentication results. These can differ. A message can pass raw DKIM but fail DKIM alignment if the signing domain does not match header_from.

Key Metrics to Track

Pass Rate

Calculate the percentage of messages where both dkim and spf in policy_evaluated return pass. A combined pass rate below 95% warrants investigation before tightening policy.

Failing Source IPs

Any IP with disposition: none but failing alignment is sending unauthenticated mail as your domain. Identify the IP using a WHOIS lookup or reverse DNS. Common causes:

• A forgotten marketing platform not yet configured with DKIM
• A CRM using your domain in the From header without authorization
• A third-party forwarding service breaking SPF

Volume by Source

Sort records by descending. High-volume failing sources carry the most risk. Low-volume failing sources may indicate targeted spoofing.

Moving from p=none to p=reject

The path to enforcement follows three stages.

Stage 1: p=none Monitor for 30 to 90 days. Collect and analyze all aggregate reports. Identify every legitimate sending source. Configure SPF and DKIM for each.

Stage 2: p=quarantine Set pct=10 initially, then increase to 100 over several weeks. Watch for legitimate mail landing in spam.

v=DMARC1; p=quarantine; pct=25; rua=mailto:[email protected];

Stage 3: p=reject Once pass rates are consistently above 98% and all legitimate sources are covered, enforce rejection.

v=DMARC1; p=reject; rua=mailto:[email protected];

p=reject is a prerequisite for BIMI. Without it, major mail clients will not display your verified logo.

Using a DMARC Report Analyzer

Parsing raw XML manually does not scale. A DMARC report analyzer aggregates data across receivers, visualizes pass rates over time, and flags anomalies. Look for tools that:

• Accept forwarded report emails automatically
• Resolve source IPs to sending services
• Track policy changes over time
• Alert on sudden volume spikes from unknown IPs

Free tools cover most needs for domains sending under one million messages per month. Enterprise platforms add threat intelligence feeds and multi-domain dashboards.

The Path to BIMI

p=reject opens the door to BIMI. BIMI (Brand Indicators for Message Identification) lets you display a verified logo next to your email in supporting clients.

Client Support in 2026

• Gmail: Supports BIMI with a Verified Mark Certificate (VMC). Displays logo in inbox list and message view.
• Apple Mail (iOS and macOS): Supports BIMI with VMC. Displays logo on devices running iOS 16+ and macOS Ventura+.
• Yahoo Mail: Supports BIMI with VMC. One of the earliest adopters of the standard.

BIMI DNS Record

default._bimi.yourdomain.com  IN TXT  "v=BIMI1; l=https://yourdomain.com/logo.svg; a=https://yourdomain.com/vmc.pem;"

The l tag points to your SVG logo. The a tag points to your VMC certificate file.

SVG Requirements

BIMI requires a specific SVG profile: SVG Tiny 1.2, square aspect ratio, no external references, no scripts, no raster images embedded. Standard SVG files exported from Illustrator or Figma will fail validation.

makeBIMI.com converts your existing logo file into a compliant BIMI SVG at no cost. Upload a PNG, JPG, or standard SVG and receive a validated, specification-compliant file ready for hosting.

VMC Certificates

A VMC is issued by an accredited Certificate Authority and binds your logo to your domain. It requires a trademark registration in a supported jurisdiction.

veriBIMI.com brokers VMC certificates from accredited authorities, guiding you through trademark verification and certificate issuance.

Summary

A DMARC report analyzer makes the XML data in aggregate reports actionable. Read the policy_evaluated fields to measure alignment, not just raw authentication results. Work through each failing sending source methodically. Move through p=quarantine with controlled pct increments before reaching p=reject. Once at full enforcement, your domain is qualified for BIMI, VMC issuance, and verified logo display across Gmail, Apple Mail, and Yahoo.

The investment is technical but finite. Every step from p=none to a verified BIMI logo is documented, repeatable, and measurable.