What is in a DMARC aggregation report?

A review of the DMARC report structure along with generation and setup.

By Stuart Larsen July 29, 2026

Purpose

DMARC reporting was built to help domain owners understand and tune their DMARC policy. It is a completely free feature built into DMARC.
It specifically lists the authentication status for each sending IP address.

Report Generation

DMARC Report Generation

When an email is received by a receiver, the receiver gets the SMTP message along with the IP address from the TCP connection. Using this information, the receiver can perform DMARC checks to determine whether the email should be accepted, quarantined, or rejected.
The receiver stores the results for each IP address and domain pair for 24 hours, then aggregates them. After 24 hours, it sends the aggregate results to the email address listed in the DMARC policy's rua tag.

Report Contents

DMARC Report Contents

A full example report can be here. Reports have three main sections: the report metadata, the published policy, and the records.
The report metadata contains information about who generated the report. In the example, the generator is Google.
policy_published contains the DMARC record that the receiver uses to evaluate messages. In this case, the policy is set to reject, with relaxed SPF and DKIM alignment.
Reports usually contain multiple record components, one for each IP address. Each record includes:
  • The sending IP address (source_ip).
  • The number of messages (count).
  • The evaluation results (policy_evaluated).
  • The authentication results (auth_results), including identifiers such as the DKIM key.
To understand who is sending the email, you can perform a reverse DNS lookup on the IP address.

What Do You Do with These Reports?

Reports should be parsed and aggregated to understand your DMARC policy rollout. In particular, look for known services or IP addresses that are experiencing authentication failures.
Ideally, you can automate this process and set up alerting to ensure that email is delivered properly. Services like dmarcdefender.io can automatically ingest, parse, aggregate, and notify you when something is misconfigured.

Setup

Setting up alerting involves adding the rua tag to your DMARC policy. For example:

v=DMARC1; p=none; rua=mailto:you@yourdomain.com

Conclusion

DMARC reports are an important tool for policy owners to understand policy effectiveness and monitor potential email authentication failures.

Ready to get started?

Start your free trial today and see how DMARC Defender can help you improve your email deliverability and protect your brand reputation.

Start 14 Day Free TrialPricing

Benefits

  • Continuous deliverability monitoring
  • Fulfil Google/Yahoo sender requirements
  • Prevent Brand Impersonation
  • Improve Deliverability