Types of DMARC Reports: Aggregate vs. Forensic

When you enable DMARC reporting, you’ll mainly receive two types of reports: Aggregate Reports and Forensic Reports. Each serves a different, but equally important, purpose.

🚨 Lifetime Deal Alert: Available Now on AppSumo! ⏳ Don’t Miss Out

DMARC Aggregate Reports (RUA)

Aggregate reports, also known as RUA reports, are like a high-level summary of your email traffic. They’re usually sent daily in an XML (Extensible Markup Language) format, which, let’s be honest, isn’t the most human-friendly thing to read on its own.

What’s in an Aggregate Report?

These reports give you a big picture of what’s going on with emails claiming to be from your domain. They contain aggregated information, meaning they summarize data without revealing sensitive content from individual emails.

You’ll typically find:

• Reporting ESP Information: Details about the email service provider that sent the report.
• Header-From Domain: The domain displayed in the “From” address of the email.
• DMARC Policy and Alignment Settings: What policy is applied (none, quarantine, or reject) and how strict your alignment is.
• Sender’s IP Address: The IP address from which the emails were sent. This is super helpful for identifying legitimate and unauthorized sending sources.
• Message Authentication Status and Data: This is key! It tells you if SPF, DKIM, and DMARC passed or failed for messages.
• Number of Messages Sent: The volume of emails from a given IP address within a specific time frame, typically 24 hours. This helps you spot unusual spikes in sending volume that might indicate a spoofing attack.
• Delivery Status: Whether emails were delivered, sent to spam, or rejected based on your DMARC policy.

Aggregate reports are invaluable for understanding your overall email infrastructure, detecting malicious emails trying to impersonate your domain, and figuring out where to start fixing configuration issues. GoBrunch Pricing: Understanding Your Options

DMARC Forensic Reports (RUF)

Forensic reports, also called failure reports, are much more detailed. These are generated when an individual email fails DMARC authentication. While aggregate reports give you statistics, forensic reports try to give you the “why.”

What’s in a Forensic Report?

Unlike aggregate reports, forensic reports can sometimes include sensitive information, which is why not all email services provide them due to privacy concerns. If you do receive them, they can contain:

• Email Subject: The subject line of the failed email.
• Email Received Time: When the email was received.
• Email Header Information: Full headers of the problematic email.
• Email Content (sometimes): The actual body of the failed email, which can be incredibly useful for investigation.
• SPF, DKIM, and DMARC Authentication Results: Detailed results for each check.
• Sender Address: The “From” and “To” email addresses.
• Email Delivery Status: How the email was handled (e.g., rejected, quarantined).
• DMARC Policy Applied: The specific policy that was enforced (none, quarantine, or reject).

Forensic reports are particularly useful for troubleshooting specific issues and for incident response. They help you pinpoint the exact reasons for authentication failures and can even help identify legitimate email sources that need proper configuration. However, for most initial DMARC implementations, focusing on aggregate reports is usually recommended.

Read more about DMARC Report Review:
What Exactly Are DMARC Reports? GoBrunch Use Cases: Who Benefits Most?