DMARC aggregate & forensic reports, parsed for you

DMARC Monitoring & Report Analyzer

yourDMARC is a DMARC monitoring tool. Mailbox providers send us your DMARC aggregate (RUA) and forensic (RUF) reports. We parse them and show every service sending as your domain and whether its SPF and DKIM align, and we alert you when something fails. It is built for IT teams, small businesses and MSPs who want to reach p=reject without blocking their own mail.

✓Every aggregate report parsed automatically, no XML to read
✓Senders, alignment and failures across all your domains
✓A guided path from p=none to p=quarantine and p=reject

Start DMARC monitoring

Scan your domain

Compare plans on the DMARC monitoring pricing page.

See it in Action

The basics

What is DMARC monitoring?

A DMARC record tells receivers what to do with mail that fails SPF and DKIM alignment. It can also ask them to report back. Those reports are the only view you get of everyone sending mail as your domain: your own mail servers, the services you send through, and anyone spoofing you.

The reports arrive as compressed XML, often several a day from each receiver. DMARC monitoring collects them, reads them and turns them into decisions. Which senders are legitimate? Which ones fail and need an SPF or DKIM fix? And when is it safe to enforce?

Who it is for

✓IT and security teams who need to find every service sending as the company domain before enforcing DMARC.
✓Small businesses meeting the Google and Yahoo bulk-sender rules, which require a DMARC record.
✓MSPs and agencies watching DMARC across many client domains from one account.

Setup

How DMARC monitoring works

One DNS change starts the reports flowing. Nothing about mail delivery changes until you decide to enforce.

Add your yourDMARC rua address

Add a domain and we give you a reporting address for the rua= tag of your DMARC record. If you have no DMARC record yet, start with p=none: monitoring only, nothing about delivery changes.

Receivers send their reports to us

Google, Microsoft, Yahoo and the other mailbox providers that send DMARC reports mail us a compressed XML aggregate report for your domain, usually once a day. We unpack and parse each one as it arrives.

Read the results, fix, then enforce

Your dashboard shows who sends as your domain and whether they pass. Fix the legitimate senders that fail, then move from p=none to p=quarantine and p=reject when the data says it is safe.

Need registrar-specific DNS steps? Follow our DMARC setup guides.

Report analyzer

How we parse DMARC aggregate and forensic reports

You never have to open an XML file. Every report that reaches your yourDMARC address is unpacked, parsed and added to your dashboard.

rua=

Aggregate (RUA) reports

The daily XML summaries that receivers send. They hold counts and authentication results, never message content. From each report we record:

✓Message volume per day, per domain and per sending IP
✓SPF and DKIM results, and whether each one aligns with the From domain
✓The DMARC result and the disposition the receiver applied: none, quarantine or reject
✓Which receiver sent each report, so a provider that stops reporting stands out
✓The policy the receiver saw for your domain at the time

ruf=

Forensic (RUF) failure reports

Reports on single messages that failed DMARC. Each one opens in its own view, with the details the receiver included:

✓The reporting organisation, feedback type and date received
✓Source IP, Header From, Envelope From, recipient and subject
✓The identity that failed, and the Authentication-Results header
✓The original message headers, when the receiver sends them

Most large mailbox providers do not send forensic reports for privacy reasons, so expect few of them. Aggregate reports carry most of the picture.

yourDMARC also collects SMTP TLS (TLS-RPT) reports and keeps a timeline of changes to your DMARC, SPF and DKIM records.

Sources & alignment

See every sender and whether it aligns

Every source that sent mail as your domain, with the SPF and DKIM results that decide whether DMARC passes.

Senders grouped by service

Sending IPs are grouped into the services behind them, such as your mail platform or a marketing tool, so you review a short list of senders instead of thousands of IP addresses. Anything we cannot attribute is kept together so it cannot hide.

Alignment at a glance

Compliance is measured as aligned DMARC passes, the way receivers judge it, not raw SPF or DKIM passes. Each sender shows its SPF and DKIM alignment, so you can see exactly which one needs fixing.

Detail on every IP

Open any source to see its reverse DNS, network (ASN), location, blocklist listings and abuse reports. That makes it quicker to tell a forwarding server or a forgotten tool from someone spoofing you.

Alerts

DMARC alerts when something changes

You should not have to check the dashboard every day to catch a problem. yourDMARC tells you when something needs a look.

→In-app alerts. Alerts are raised per domain and marked critical, warning or informational, so the urgent ones are easy to find.
→Daily email alerts. Email alerts when a domain stops receiving reports, when TLS-RPT shows delivery failures, when a sending IP is blocklisted, or when a domain's DMARC policy changes.
→Weekly summary. A Monday report covers all your domains, with a “What changed this week” section: compliance drops, a rise in quarantined mail, new senders and senders whose pass rate fell.

Set up DMARC alerts

yourDMARC dashboard showing DMARC report data by sender

Enforcement

From p=none to p=reject, step by step

Monitoring is how you get to enforcement safely. For each domain, yourDMARC lists the senders that still fail, recommends the next policy step and the exact record to publish, and marks a domain as ready to tighten once its legitimate mail passes.

p=none

Observe

Reports arrive and nothing about delivery changes.

p=quarantine

Quarantine

Mail that fails DMARC is sent to spam.

p=reject

Enforce

Mail that fails DMARC is refused.

Planning the move? Read the DMARC enforcement guide, or let hosted DMARC apply each step for you. Want to know what each policy does to failing mail? Read how DMARC quarantine works.

Multi-domain

DMARC monitoring for MSPs and multi-domain teams

Parked domains, regional domains and client domains all need DMARC. yourDMARC keeps them in one account, with a view across every domain that shows which ones need attention first.

✓An account-wide dashboard: mail over time, failing senders and the domains that need attention
✓Drill down from the account view to a single domain or sender
✓Extra users on the same account
✓Your own logo through account branding

Reselling or managing DMARC for clients? See the MSP partner program, or let our team run it for you with managed DMARC.

Monitoring DMARC across many domains in yourDMARC

FAQ

DMARC monitoring questions

What is DMARC monitoring?

DMARC monitoring is collecting and reading the reports that mailbox providers send about mail that uses your domain. Aggregate (RUA) reports show every server that sent as your domain and whether SPF and DKIM passed and aligned. Forensic (RUF) reports describe individual messages that failed. Monitoring turns those reports into a list of senders to fix, so you can move your DMARC policy to p=reject without blocking your own mail.

What is the difference between DMARC aggregate (RUA) and forensic (RUF) reports?

Aggregate reports, requested with the rua= tag, are XML summaries that receivers usually send once a day: counts of messages by sending IP, with SPF, DKIM and DMARC results. They contain no message content. Forensic or failure reports, requested with the ruf= tag, describe single failing messages and can include headers. Most large mailbox providers do not send forensic reports, so aggregate reports carry most of the data.

Is yourDMARC a DMARC report analyzer?

Yes. Instead of opening XML files by hand, you point your rua= tag at yourDMARC and every report that arrives is parsed and added to your dashboard. You see volume, senders, alignment and policy results across all your domains, and you can open the forensic reports a receiver sent.

Will DMARC monitoring affect my email delivery?

No. Adding a reporting address changes where reports go, not how mail is handled. With p=none, receivers deliver mail as they did before. Delivery only changes when you choose to move to p=quarantine or p=reject.

How long until I see data?

Most receivers send aggregate reports once a day, so the first reports usually arrive within a day or two of publishing the rua= address. Mail volume and the mix of receivers you send to decide how much data you see.

Can I monitor many domains, including clients' domains?

Yes. One account holds many domains, with an account-wide view of all of them, extra users and your own logo. How many domains you can add depends on your plan; see the pricing page for the limits.

More on reading reports: using DMARC reports for threat intelligence.