What aggregate DMARC reports are
If the DMARC record specifies an rua address, mail providers (Gmail, Outlook, Yahoo and others) send a report to it once a day: which IP addresses sent messages with your domain in the “From” field, how many there were and whether they passed SPF and DKIM. The report is an XML file, often compressed as ZIP or GZ, which is awkward to read by hand.
How to read the result
- Passed — the message passed DKIM or SPF with domain alignment. These are your legitimate services.
- Failed from addresses you recognise — a service you use but haven't added to SPF or set up DKIM for. Fix this before tightening the policy.
- Failed from unknown addresses — most likely attempts to spoof your domain. This is exactly what a quarantine or reject policy protects against.
The file is processed in server memory and is not stored.