Reading DMARC reports so they stop being noise

After switching on DMARC with a p=none policy, daily aggregate reports start arriving from receiving servers. It is the only place where you can see who really sends mail on your domain’s behalf — including systems nobody at the company remembered.

The problem is that raw they are unreadable, so most rollouts stop at this stage: the record exists, reports arrive, nobody opens them, the policy stays at p=none forever.

First: do not read this by hand

Reports are XML inside a ZIP or GZIP archive, one per large provider per day. Opening them in an editor makes no sense.

Several free tools turn them into a readable table — some as a service you forward reports to, some as a program you run locally. The choice matters in one respect only: an external service will see who writes to you and with whom you correspond. With sensitive correspondence, pick a tool that runs locally.

What is in a report

For every IP address sending mail from your domain, the report gives:

• how many messages came from it,
• the SPF result — whether the address was allowed to send,
• the DKIM result — whether the signature matched,
• SPF alignment and DKIM alignment — and this is the important part,
• what the recipient did with it.

The thing that confuses everyone at first

The column “SPF: pass” does not mean the message passed DMARC.

SPF checks the domain in the message envelope, while the user sees an entirely different field: the From header. DMARC requires that the domain visible to a human matches the one that passed the check. If a sending system substitutes its own envelope domain, SPF will pass and alignment will not.

So when reading a report you look at the alignment columns, not the raw results. A message passes DMARC when either SPF or DKIM is aligned — one of the two is enough.

Three groups every report divides into

1. Known and aligned — nothing to do

Your mail server, your provider. A growing number of messages in this group is precisely the point.

2. Known and not aligned — this is the actual work

The address belongs to a service the company uses, but messages do not pass. Typically: the invoicing system, a quoting tool, the website form, monitoring, the printer.

The fix depends on what the service allows:

• Best: DKIM. Most serious services let you sign with your own domain — you add one selector record. A DKIM signature also survives forwarding, which SPF does not.
• Worse but workable: adding to SPF. Remember the limit of ten DNS lookups — after the fourth or fifth service it is easy to cross, and then SPF stops working entirely.
• Sometimes: changing the sender address to a subdomain dedicated to that service.

3. Unknown and not aligned — usually not what it looks like

The instinct says “somebody is impersonating us”. Before drawing that conclusion, check the three most common explanations first:

Mail forwarding. Somebody forwards to a personal address. The forwarding server sends onward from its own address, so SPF does not pass — DKIM does, if it is set up properly. This is the most common reason for “odd” entries and is not a fault.

A service you did not know about. Somebody in the company signed up for a tool that sends mail from a company address.

An autoresponder to a non-existent recipient.

Only when those are ruled out does actual impersonation remain. That usually shows as many IP addresses from various countries and large message counts.

When you can move on

The condition for going from p=none to quarantine is single: for at least a week, nothing unknown and unaligned appears in the reports.

A month of observation is the minimum, because monthly processes — invoice runs, reports, reminders — will only show up once.

Then p=quarantine with pct=25, raising it: 25 → 50 → 100. Finally p=reject.

What to do with reports afterwards

Once at p=reject, keep reports switched on and look at them once a quarter. A new service added by somebody in the company will show up exactly there — as rejected messages, before anyone reports that “invoices are not arriving”.

It is the cheapest monitoring in existence for who sends mail in the company’s name.