How to Publish a DMARC Aggregate Reporting Policy and Read the Reports

When this control is useful

DMARC aggregate reports (RUA) summarize authentication results observed by receiving systems. They help identify legitimate senders, misaligned services, spoofing attempts, and changes in authentication behavior. They are XML data and are not a per-message delivery receipt or a complete view of every recipient.

Implementation procedure

Choose a monitored mailbox or a reputable report processor that can safely receive and parse compressed XML attachments. Add a `rua` destination to the DMARC TXT record using the required mailto syntax. If reports are sent to a different organizational domain, publish the external-report authorization record requested by the DMARC specification. Keep the existing policy and reporting address changes separate so that failures can be isolated.

Worked scenario

Create a source inventory with sending service, visible From domain, SPF result, DKIM result, alignment result, volume, and business owner. Compare new report sources with known systems such as CRM, billing, support, and marketing platforms. Investigate unfamiliar sources before classifying them as malicious; shared infrastructure and forwarding can complicate interpretation.

How to verify the result

Verify the DNS record, wait for receiving providers to begin sending reports, and confirm that the parser accepts the XML. Check reporting coverage across providers and dates. A sudden absence of reports may mean a receiver does not send them, the mailbox is rejecting attachments, or the external authorization is missing.

Failure modes and safeguards

Do not publish a `rua` address that nobody monitors, expose report attachments broadly, or treat every SPF failure as a spoofing incident. Aggregate data is delayed and sampled by participating receivers; use message headers and provider logs for individual investigations.

Implementation checklist

• Assign a technical owner and record the affected domain or service.
• Save the current configuration before making a change.
• Make one controlled change at a time and document the reason.
• Verify behavior using DNS results, message headers, or provider telemetry as appropriate.
• Record exceptions, rollback criteria, and the date of the next review.

Questions to resolve before deployment

Who owns the affected sending system? Which production messages depend on it? What evidence will demonstrate success? Who will respond if the change causes a delivery problem? Answer these questions before enforcing the configuration.