What is a DMARC aggregate report? (RUA)

Definition

An aggregate report is a compressed XML file a receiving mail system emails to the address in your DMARC record's rua= tag. Each report covers a window (normally 24 hours) and summarizes, per sending IP: how many messages used your domain in the From line, the SPF and DKIM results, alignment, and what the receiver did with the mail. RUA is the tag name, rua=: the reporting URI for aggregate data.

What is inside (and what is not)

Reports are counts, not content. A report row says “this IP sent 1,240 messages as your domain; DKIM passed and aligned; disposition none.” It never includes message bodies, subject lines, or recipient addresses, which is exactly why providers are willing to send them: they carry authentication telemetry, not mail. The per-message variant with actual headers is the forensic report, and almost nobody sends those.

Who sends them

Most of the large mailbox providers: Google, Microsoft, Yahoo, and many regional and security-focused receivers. Coverage is broad but not universal, and reports arrive on the reporter's schedule, typically once a day, often lagging a day behind the mail they describe. Expect a picture that assembles over days, not a live feed.

Why they matter

Aggregate reports are the only visibility DMARC gives you, and the entire basis for moving to enforcement safely. They answer the two questions that matter: which legitimate services send as your domain (so you can fix the ones failing alignment before a strict policy hurts them), and who is spoofing you (so you can see what receivers did with it under your policy). Raw XML at fleet scale is unreadable by design; a DMARC monitor's job is to parse, classify senders, and turn the receipts into decisions.