How to Set Up DMARC Reporting (Reading RUA XML Reports)
To set up DMARC reporting, append an aggregate reporting tag (rua=mailto:) to your domain's DMARC TXT record in your DNS settings. This instructs email providers like Gmail to send daily XML data reports mapping all IP addresses attempting to send email under your domain name.
RUA Aggregate Reports vs RUF Forensic Reports
DMARC offers two reporting modes, each serving a distinct purpose:
Report Type | Tag | Content | Frequency |
Aggregate (RUA) | rua=mailto: | IP addresses, pass/fail counts, policy results | Daily |
Forensic (RUF) | ruf=mailto: | Individual message headers, full failure details | Per failure |
RUA reports are the standard monitoring tool. Each receiving mail server that processes your domain sends a compressed XML file daily, summarizing every IP that attempted to send as your domain and whether each passed SPF and DKIM checks.
RUF reports contain more sensitive data including message headers. Many providers (including Gmail) no longer send RUF reports due to privacy concerns. RUA is the reliable, universally supported option.
Why It Matters: Visibility Into Your Domain's Use
Without DMARC reporting, you operate blind. Phishing emails using your domain's identity go undetected. Legitimate services you've forgotten about silently fail authentication.
What RUA reports reveal:
- Every IP address sending email as your domain
- Whether each source passes SPF, DKIM, or both
- Which receiving servers are processing your mail
- Active spoofing attempts with source IP identification
This data drives two critical decisions: authorizing forgotten senders (fixing false failures) and identifying attacker IPs for threat intelligence.
Constructing the DMARC DNS String
A complete DMARC record with both reporting tags looks like this:
v=DMARC1; p=none; rua=mailto:[email protected]; ruf=mailto:[email protected]; pct=100
Key attributes:
- v=DMARC1: required version tag
- p=none: monitoring-only policy for initial setup
- rua=mailto:: destination for aggregate XML reports
- ruf=mailto:: destination for forensic reports (optional)
- pct=100: apply policy to 100% of mail
Add to DNS in NameSilo:
- Type: TXT
- Host: _dmarc
- Value: your complete DMARC string
- TTL: 3600
Reports begin arriving within 24 hours of DNS propagation, as receiving servers send their first daily digest.
The XML Challenge: Parsing Raw Reports
Each RUA report arrives as a .zip or .gz file containing an XML document. Opening it manually produces hundreds of lines of machine-readable data:
<row>
<source_ip>192.0.2.1</source_ip>
<count>847</count>
<policy_evaluated>
<dkim>pass</dkim>
<spf>fail</spf>
</policy_evaluated>
</row>
Reading raw XML at scale is impractical. A domain receiving 50 reports daily cannot be manually audited. Use a DMARC aggregation tool to parse, visualize, and alert on report data:
Free tools: MXToolbox DMARC Report, DMARC Digests, Postmark's free analyzer
Paid platforms: Dmarcian, Valimail, and EasyDMARC offer timeline views, IP reputation lookups, and policy upgrade recommendations.
These tools accept your rua email address as the report destination and parse incoming XML automatically.
Common Mistakes
Using your primary inbox as the rua destination: High-volume domains receive hundreds of XML attachments daily. Set up a dedicated inbox specifically for DMARC reports, such as [email protected]. This isolates the data flow and prevents your working inbox from becoming unusable.
Starting with p=reject before analyzing reports: Always start at p=none to collect baseline data. Advancing to enforcement without reviewing RUA reports risks blocking legitimate mail streams you hadn't identified.
Ignoring reports after deployment: DMARC reports are actionable intelligence. Review them weekly during the first 90 days to catch new legitimate senders and emerging spoofing campaigns.
What This Means for You
NameSilo Email via Titan is fully compatible with DMARC reporting infrastructure. Add your _dmarc TXT record in NameSilo DNS Manager to begin capturing aggregate data.
Need a domain to protect? Search available names at NameSilo.
Frequently Asked Questions
What is a DMARC RUA report?
A daily XML digest from receiving servers showing all IPs sending as your domain.
What does rua=mailto look like in DNS?
v=DMARC1; p=none; rua=mailto:[email protected]
How do I read a raw DMARC XML file?
Use a DMARC aggregation tool like Dmarcian or MXToolbox.
Are DMARC aggregate reports free?
Yes. Receiving servers send them free. Parsing tools vary.
Where should I send my DMARC reports?
A dedicated inbox like [email protected], not your primary address.
Does DMARC reporting help email deliverability?
Yes. It identifies failing senders you can then authorize.
What is the difference between RUA and RUF reports?
RUA: daily aggregate counts. RUF: individual failure message headers.
How do I add DMARC reporting tags in NameSilo?
DNS Manager, TXT record, host _dmarc, paste full DMARC string.
NameSilo Staff
The NameSilo staff of writers worked together on this post. It was a combination of efforts from our passionate writers that produce content to educate and provide insights for all our readers.
