Understanding DMARC aggregate reports
Aggregate reports (RUA) are daily XML summaries from mailbox providers. They describe how much mail used your domain, whether SPF and DKIM passed, and how the receiver disposed of messages under your published policy.
What to look for
- Volume by source IP — large unexpected IPs often mean a forgotten SaaS sender or abuse.
- SPF and DKIM results — you want legitimate streams passing at least one aligned mechanism.
- Policy disposition — even on
p=none, providers may note recommended handling; track trends before moving to quarantine. - Subdomain traffic — use
sp=when marketing or support subdomains need different enforcement.
DMARC Autopilot can ingest aggregate files so you can see sender tables and enforcement readiness in one place after you sign in.
Start with a DNS scan