What is a DMARC aggregate report? (RUA)

Definition

An aggregate report is a compressed XML file a receiving mail system emails to the address in your DMARC record's rua= tag. Each report covers a window (normally 24 hours) and summarizes, per sending IP: how many messages used your domain in the From line, the SPF and DKIM results, alignment, and what the receiver did with the mail. RUA stands for Reporting URI for Aggregate data.

What is inside (and what is not)

Reports are counts, not content. A report row says “this IP sent 1,240 messages as your domain; DKIM passed and aligned; disposition none.” It never includes message bodies, subject lines, or recipient addresses, which is exactly why providers are willing to send them: they carry authentication telemetry, not mail. The per-message variant with actual headers is the forensic report, and almost nobody sends those.

Who sends them

Most of the large mailbox providers: Google, Microsoft, Yahoo, and many regional and security-focused receivers. Coverage is broad but not universal, and reports arrive on the reporter's schedule, typically once a day, often lagging a day behind the mail they describe. Expect a picture that assembles over days, not a live feed.

Why they matter

Aggregate reports are the only visibility DMARC gives you, and the entire basis for moving to enforcement safely. They answer the two questions that matter: which legitimate services send as your domain (so you can fix the ones failing alignment before a strict policy hurts them), and who is spoofing you (so you can see your policy actually blocking it). Raw XML at fleet scale is unreadable by design; a DMARC monitor's job is to parse, classify senders, and turn the receipts into decisions.