DMARC Aggregate Reports: What They Reveal
Security Boulevard, Wednesday, June 17th, 2026
DMARC aggregate (RUA) reports give a daily summary of all email sent using your domain and who is sending it.
DMARC aggregate reports provide a comprehensive summary of email traffic using your domain, showing whether messages pass or fail SPF and DKIM and which IP addresses are sending them. Each report breaks down every sending source with its SPF result, DKIM result, and the policy applied.
They are the primary tool for spotting spoofing attempts and misconfigured legitimate services, and they reveal every third-party service sending on your behalf, helping surface unauthorized tools or old platforms. Unlike forensic reports, RUA reports contain no email body content or PII, making them safe for privacy compliance. Sent daily in XML, they are typically read using an automated analyzer.