DMARC Reports Guide

What aggregate reports show

DMARC aggregate reports are XML files sent by mailbox providers. They summarize authentication results for mail claiming to be from your domain.

Useful fields include:

1. Source IP.
2. Message count.
3. Disposition.
4. SPF result.
5. DKIM result.
6. Header From domain.
7. Alignment pass or fail.

Postscale parses those reports so you do not need to inspect XML manually.

Start with source discovery

Before enforcing DMARC, identify every legitimate sender:

Unknown sources are not always malicious. Some are forgotten SaaS tools.

Fix alignment failures

DMARC cares about alignment with the visible From domain.

Common fixes:

1. Configure DKIM for each third-party sender.
2. Use a custom Return-Path where SPF alignment matters.
3. Stop services from sending as the root domain when they cannot authenticate.
4. Move risky mail to a subdomain.

If a source cannot pass SPF or DKIM alignment, it should not send as the protected domain.

Roll out policy gradually

Use reports to move in stages:

_dmarc.example.com. TXT "v=DMARC1; p=none; rua=mailto:dmarc@example.com"

Then:

1. Fix known legitimate failures.
2. Move to p=quarantine; pct=25.
3. Watch reports for false positives.
4. Increase pct.
5. Move to p=reject when stable.

Do not skip the monitoring stage unless the domain has no legitimate mail.

Investigate spikes

Spikes often indicate:

1. A new product integration.
2. A marketing campaign.
3. Forwarding behavior.
4. A spoofing attempt.
5. A DNS or DKIM rotation mistake.

Cross-check with deployment history before assuming abuse.