DMARC Reports

DMARC (Domain-based Message Authentication, Reporting & Conformance) aggregate reports give you visibility into who is sending email as your domain and whether those emails pass DKIM and SPF authentication. Postscale automatically collects, parses, and visualizes these reports in your dashboard.

How It Works

When you add a domain, Postscale generates a unique DMARC report address (e.g., abc123@dmarc.postscale.io)
You add a DMARC DNS record with rua=mailto:{address}@dmarc.postscale.io
ISPs like Google, Yahoo, and Microsoft send daily aggregate reports to that address
Postscale parses the XML reports and displays the data in your domain's DMARC tab

Report delivery

ISPs typically send DMARC aggregate reports once every 24 hours. It may take 24-48 hours after setting up your DNS record before you receive your first report.

Setting Up DMARC Reporting

1. Get Your DMARC Address

Navigate to your domain in the dashboard and open the DMARC tab. Your unique report address is displayed at the top of the page. You can also find it in the DNS Records tab as part of the recommended DMARC record.

Alternatively, use the API:

curl -H "Authorization: Bearer YOUR_API_KEY" \
  https://api.postscale.io/v1/domains/{domain_id}/dmarc/address

2. Add the DNS Record

Add a TXT record for _dmarc.yourdomain.com:

v=DMARC1; p=quarantine; rua=mailto:{address}@dmarc.postscale.io

Replace {address} with the address shown in your dashboard.

3. Verify the Record

Use the Verify DNS button in your domain settings to confirm the DMARC record is correctly configured.

Dashboard

The DMARC tab in your domain detail page shows:

Summary Cards

Total Messages — Number of emails reported across all aggregate reports
Alignment Rate — Percentage of messages that passed both DKIM and SPF alignment
DKIM Pass Rate — Percentage of messages that passed DKIM authentication
SPF Pass Rate — Percentage of messages that passed SPF authentication

Daily Alignment Chart

A bar chart showing daily email volumes with color-coded alignment rates:

Green bars indicate high alignment (above 90%)
Yellow bars indicate moderate alignment (70-90%)
Red bars indicate low alignment (below 70%)

Source IP Table

A breakdown of sending IP addresses showing:

Source IP address
Total message count
DKIM pass count and rate
SPF pass count and rate

This helps you identify unauthorized senders or misconfigured mail servers.

Recent Reports

A list of aggregate reports received, showing the reporting organization, date range, and message counts.

API Endpoints

All DMARC endpoints require authentication and are scoped to a specific domain.

Get Summary

GET /v1/domains/{id}/dmarc/summary?days=30

Returns aggregated DMARC statistics for the specified time period.

Get Source IPs

GET /v1/domains/{id}/dmarc/sources?days=30&limit=20

Returns a breakdown of sending IP addresses with authentication results.

Get Daily Alignment

GET /v1/domains/{id}/dmarc/daily?days=30

Returns time-series data of daily email volumes and alignment rates.

List Reports

GET /v1/domains/{id}/dmarc/reports?limit=20&offset=0

Returns a paginated list of aggregate reports.

Get Report Detail

GET /v1/domains/{id}/dmarc/reports/{reportId}

Returns a single report with all individual records.

Get DMARC Address

GET /v1/domains/{id}/dmarc/address

Returns the domain's DMARC report address. Creates one if it doesn't exist yet.

Understanding DMARC Alignment

DMARC alignment checks that the domain in the From: header matches the domains used in DKIM signing and SPF authentication:

DKIM alignment — The d= domain in the DKIM signature matches the From: domain
SPF alignment — The Return-Path domain matches the From: domain

A message passes DMARC if either DKIM or SPF alignment passes.

DMARC Policies

Your DMARC policy tells receiving mail servers what to do when a message fails authentication:

Policy	Behavior
`p=none`	Monitor only — collect reports but take no action on failures
`p=quarantine`	Send failing messages to the spam/junk folder
`p=reject`	Reject failing messages outright

Gradual enforcement

Start with p=none to collect data without affecting delivery. Once you confirm all legitimate senders pass alignment, move to p=quarantine, then p=reject.

Troubleshooting

No reports received

Verify the _dmarc TXT record is published correctly: dig TXT _dmarc.yourdomain.com
Ensure the rua= value uses your Postscale DMARC address
Reports are sent daily — wait at least 24-48 hours after DNS setup
Some smaller ISPs may not send DMARC reports

Low alignment rates

Check the source IP table to identify which senders are failing
Ensure all legitimate mail services are included in your SPF record
Verify DKIM signing is enabled for all sending services
Third-party services (marketing tools, CRMs) often need their own SPF/DKIM configuration

Unknown source IPs

Use the source IP table to identify IPs sending as your domain. Common sources include:

Your own mail servers
Third-party services (Google Workspace, Microsoft 365, marketing tools)
Forwarding servers (mailing lists, forwarding services)
Unauthorized senders (potential spoofing)