Configuring DMARC Reporting (rua and ruf)

Leveraging DMARC XML Reports

DMARC is not just about blocking unauthorized emails; it is also a powerful diagnostic tool. By adding report tags to your DMARC record, you direct receiving mail servers to send daily XML summaries of all email traffic claiming to be from your domain.

Understanding the RUA and RUF Tags

• RUA (Aggregate Reports): rua=mailto:dmarc@yourdomain.com collects daily statistical summaries showing which IPs sent mail, whether SPF/DKIM passed, and their alignment status.
• RUF (Forensic Reports): ruf=mailto:dmarc@yourdomain.com provides real-time copies of individual emails that failed authentication, including original headers (subject to privacy limitations).

We recommend using dedicated DMARC monitoring tools to parse these raw XML files, as they can be difficult to read manually. This analysis is vital to ensuring all your email sources are verified before moving to a strict reject policy.