How to start getting the reports
The reports come from one tag in your DMARC record, rua, which says where to send them. If your domain has no DMARC record yet, this is enough to start:
v=DMARC1; p=none; rua=mailto:dmarc-reports@yourcompany.co.uk
Source: RFC Editor, RFC 9989.
A policy of p=none changes nothing about how your mail is delivered, so this record is safe to publish today. If you already have a DMARC record, check that it has a rua address and that someone reads the mailbox it points to. The DMARC checker shows you what yours says.
What a report actually says
Each report covers a day of mail at one inbox provider. It holds no message content and no recipients' addresses. What it does hold is a row for each server that sent mail as you, and each row has these parts:
| In the report | What it tells you |
|---|---|
source_ip | The address of the server that sent the mail |
count | How many messages that server sent as you |
spf | Whether the server was on an SPF list, and for which domain |
dkim | Whether the mail carried a valid signature, and for which domain |
disposition | What the provider did with it: delivered, junked or refused |
That is useful, and hard to read. The reports arrive as compressed XML files attached to emails, from every provider, every day. Each sender appears as a bare IP address. Turning 203.0.113.7 into "your accounts software" is the real work.
What you will find in them
Once the addresses have names, every sender falls into one of five groups. Each one looks different in the reports and asks something different of you.
Your main mail service
Microsoft 365 or Google Workspace, sending most of your mail. It should pass both SPF and DKIM. If it passes SPF but not DKIM, signing has not been switched on for your domain, and that is the first thing to fix.
The services you pay for
Your newsletter platform, accounts software, CRM or booking system, each sending a smaller amount from its own servers. Many of them pass SPF for their own domain but not for yours, and DMARC does not count that. The fix is to set up DKIM signing with your domain in each one. Reputable services offer it in their settings.
The services nobody mentioned
A tool a team signed up for, a plugin on the website, an old system still running somewhere. They look like strangers at first, because nobody recognises the name. The organisation behind the address usually gives it away: a known software company sending a steady trickle of mail is likely to be a tool someone set up. Find out who uses it. If someone does, set it up properly. If nobody does, switch it off.
Forwarded mail
Your own messages, sent on by someone else's mailbox, such as a client who forwards everything from an old address. The forwarding server is not on your SPF list, so SPF fails. Your DKIM signature usually survives the trip, so the message still passes DMARC if your mail is signed. This is your mail taking a detour, and there is nothing to fix on your side.
Forgeries
Servers you have no connection with, sending mail as you and failing both checks. This is the mail DMARC exists to stop. At p=none it is delivered as normal. Once your policy is enforced, inboxes junk it or refuse it. Is it safe to switch DMARC to reject? covers when to make that move.
What this looks like in OuterMark
In the portal, each sender is listed with its organisation, network and country. A sender that cannot be placed is put to you as a question:
Is this sender yours?
Forgeries are grouped into campaigns, so you can see what is being sent in your name and whether your policy stopped it. A campaign your policy blocked is logged and never emailed to you. A live one is emailed to you once, and again only if it grows.
Campaigns in your name
Blocked by your policy✓ Blocked
Some reached an inboxLive
Reading them yourself, or having them read
You can read the reports yourself. Open the attachment, unzip it, and look up each IP address to see whose server it is. For a small domain with one mail service, that is a manageable job.
It stops being manageable when there are several domains, many sending services and a report from every provider every day. That is what Posture Monitoring is for. We read the reports, name every sender and tell you when something changes.
The short version
Your DMARC reports list every server sending email as your domain. Publish a DMARC record with a rua address to start receiving them, then put a name to each sender. Your own services you set up properly, forwarded mail you can leave alone, and the forgeries are what an enforced policy stops.
To see what your domain publishes now, run the free check. It reads your SPF, DKIM and DMARC records in about 30 seconds.