If you've published a DMARC record with an rua= tag, you're already receiving aggregate reports. They contain some of the most useful data your domain will ever generate. This page explains what's in them, why they matter, and what you're supposed to do with them.
An aggregate report is an XML file sent to you by a receiving mail server. It covers a period of time — usually 24 hours — and contains data about every email that server received claiming to be from your domain.
The reports are specified by the DMARC standard and generated automatically by compliant receivers. You don't request them individually; you publish an rua= address in your DMARC record and they start arriving. A typical domain receives reports from dozens of different receivers. A large sender might receive hundreds or thousands per day.
The reports arrive as email attachments, usually gzipped or zipped XML files. They're machine-readable by design, not human-readable. This is intentional — they're meant to be processed by software. But understanding what's in them is essential to using DMARC effectively.
Each report contains two main sections: metadata about the report itself, and one or more records describing email traffic.
The top of every report identifies who generated it, what period it covers, and what DMARC policy they observed for your domain:
google.com, outlook.com, yahoo.com)none, quarantine, or reject)This metadata tells you who is reporting, when, and what they understood your policy to be. If you've recently changed your DMARC record, this is how you confirm that receivers are picking up the updated policy.
The body of the report contains one or more <record> entries. Each record represents a group of messages sharing the same characteristics:
none, quarantine, or reject)This is where the real value lives. Each row is a window into a specific sending source and how its email is being authenticated.
If you already have a DMARC record with an rua= address, you're generating data right now. The question is whether you're using it.