How to Read a DMARC Aggregate Report

What the XML contains, the fields that matter, and the three questions every report should answer.

By Henry Timmes · Email Deliverability Consultant · Named contributor to RFC 7489 & RFC 9989 (DMARC)
DMARCReportingEmail Authentication
Henry Timmes
Henry Timmes Email Deliverability Consultant · Named contributor to RFC 7489 & RFC 9989 (DMARC)

What the XML contains, the fields that matter, and the three questions every report should answer.

What DMARC Reports Are

When you publish a DMARC record with a rua address, participating receivers send you daily aggregate reports - XML files summarizing every message they saw claiming to be from your domain, how much mail came from each source IP, and whether it passed SPF, DKIM and alignment. They are the map of who sends as you.

Why They Look Intimidating (and How to Read Them)

Aggregate reports arrive as raw XML, which is why most people never read them. Each report has a header (who sent it, the date range, your published policy) and a series of record blocks. Each record shows a source IP, a message count, and the SPF, DKIM and DMARC results. A DMARC dashboard tool will parse these into a readable table - but it helps to know what the fields mean.

The Fields That Matter

FieldWhat it tells you
source_ipThe server that sent the mail - identify which of your services (or a spoofer) it is.
countHow many messages came from that IP in the period.
spf / dkim resultWhether each authentication check passed for that source.
dispositionWhat the receiver did (none / quarantine / reject) under your policy.
alignmentWhether the passing domain matched your From domain - the thing that decides DMARC pass/fail.

What to Look For

Three questions answer most of it: Are all my legitimate sources passing and aligning? Is there an unknown IP sending volume as my domain (a spoofer, or a forgotten service)? And as I tighten policy, is any legitimate mail being quarantined or rejected? The reports answer all three - which is why they must be clean before you move to p=reject.

Frequently Asked Questions

How do I read a DMARC report?

DMARC aggregate reports are XML files listing each source IP sending as your domain, the message count, and SPF/DKIM/alignment results. Read them to confirm legitimate sources pass and align, spot unknown senders, and check nothing legitimate is being blocked. A DMARC dashboard parses the XML into a readable table.

Why are DMARC reports in XML?

The aggregate report format defined in the DMARC standard is XML, meant for machine parsing. Use a DMARC monitoring tool to turn the raw XML into readable tables, but understanding the key fields - source IP, count, SPF/DKIM result, disposition, alignment - helps you act on them.

What should a healthy DMARC report show?

All your legitimate sending sources passing SPF and/or DKIM and aligning with your From domain, no unknown IPs sending meaningful volume, and no legitimate mail being quarantined or rejected as you tighten policy.

Emails landing in spam?

Henry Timmes diagnoses why your mail isn't reaching the inbox - Microsoft 365, Gmail, Yahoo and beyond - and maps a practical fix. Book a free 15-minute call, no obligation.

Book a free consultation