What is a DMARC forensic report? (RUF)

Definition

A forensic report (the standard calls it a failure report; RUF is the tag name, ruf=, the reporting URI for failure data) is a notice generated for an individual message that failed DMARC, sent to the address in your record's ruf= tag. Unlike the counts-only aggregate report, a failure report can carry the failing message's headers, and sometimes a redacted copy of the message itself.

Why almost nobody sends them

A report that includes headers or content from a real message is, potentially, a copy of someone's private email handed to a third party. Privacy law made that exposure hard to justify, and the current standard (RFC 9991, the DMARCbis failure-reporting document) says plainly that many large providers limit or disable failure reports and rely on aggregate reports instead. Google says Gmail does not support the ruf= tag; Microsoft says Microsoft 365 sends no failure reports even when the tag is present. The receivers that still do typically redact heavily. Publishing a ruf= address is harmless, but expect a trickle at most, skewed toward smaller receivers.

Do you need ruf= at all?

For most domains, no. Enforcement decisions are made on aggregate data: which senders fail, at what volume, from where. The rare argument for ruf= is incident forensics, where a single sample of a live phishing campaign has investigative value. If you do publish one, point it at a mailbox you control operationally (samples can contain hostile content) and treat whatever arrives as a bonus, never as coverage. Your real visibility is the RUA stream.