DMARC monitoring
DMARC monitoring means reviewing reports about messages that claim to come from a domain and whether those messages passed SPF, DKIM, and DMARC checks. The reports help a domain owner find legitimate services that are not authenticated correctly and identify unauthorized sources using the domain name.
What is in an aggregate report?
Receiving mail systems can send aggregate reports, which group together results for multiple messages, to the address named in a domain's DMARC DNS record. Reports usually use XML, a structured data format, and group results by sending system and outcome. They can show sending IP addresses, message counts, results of sender checks, whether domains match under DMARC's rules (alignment), and how messages were handled under the policy. They are summaries, not copies of individual messages, and they do not establish who sent a particular message.
For example, Alex's organization reviews a report and finds messages sent by its newsletter provider that fail DMARC. The source might be a legitimate service whose DKIM or SPF domain is not aligned with the organization's visible From domain. Alex should confirm the sender and correct the authentication configuration before moving to a stricter policy. A report can also show an unfamiliar source, but that alone does not prove abuse.
Why start with monitoring?
The current DMARC standard recommends using a monitoring policy while the domain owner checks that all legitimate sending services are accounted for. Reports can be large, machine-readable files, so a monitoring service or a program that reads the report data is often used. After correcting legitimate senders and understanding the reports, an organization can decide whether a quarantine or reject policy is appropriate.
Reports may be delayed, incomplete, or differ between providers. They can expose domain-level email activity to the reporting address, so choose that destination carefully. Monitoring does not itself block messages, and a p=none policy does not mean the receiving provider will never filter mail for other reasons.
Related terms
- DMARC — defines policy, alignment, and reporting
- SPF — authentication result included in reports
- DKIM — signature result included in reports
- Email spoofing — one possible source of unexpected traffic