DMARC aggregate reports (sometimes called RUA reports) are how you find out who is sending email using your domains, and how much of that mail passes authentication. Each day, mailbox providers send these reports back, and DMARCER gathers them, groups them by domain and by sending source, and lays them out for you on the Delivery Reports page. Reading them carefully is what lets you tighten your policy to quarantine or reject with confidence, without accidentally blocking your own genuine senders.
What the page shows
Open Delivery Reports from the main navigation. You will only see domains where you have finished confirming ownership, because those are the ones DMARCER is collecting reports for. At the top of the results card, three headline tiles summarise whatever your filters are currently showing: Messages (the total volume reported), Compliant (how many of those passed) and Overall compliance (the overall pass rate, weighted by how much mail each domain sent).
Below the tiles you get one row per domain. The key columns are:
- Messages: the total number of email messages that receivers reported for that domain in the period you have chosen.
- Compliance: the DMARC pass rate, shown as a colour-coded badge. Green is 95% or higher, amber is 70 to 95%, and red is below 70%. A grey "no data" badge simply means no reports arrived for that domain in the period.
- Aligned SPF and Aligned DKIM: how many messages passed SPF, or DKIM, and matched your From domain. The matching part matters: a plain SPF or DKIM pass is not enough for DMARC unless it lines up with the address your mail is sent from.
- None, Quarantine and Reject: what the receiving mail providers did with the messages. None means delivered (you are only monitoring), Quarantine means sent to spam, and Reject means blocked.
- DKIM: a quick health indicator for the DKIM selectors seen on the domain. Click it to see the detail for each selector over the period.
- TLS-RPT: reporting on whether your mail was delivered over an encrypted (TLS) connection. This only applies to domains using DMARCER-hosted MTA-STS; other domains show a dash.
- Last report: the end date of the most recent report covering the domain.
Choosing a period and filtering
The filter panel on the left controls everything on the page. The most important control is Period. Pick a preset (Last 7 days, Last 14 days, Last 30 days, Last 90 days, Last 6 months or Last 12 months), or choose Custom range and set the From and To dates yourself. Editing the dates directly switches the dropdown to Custom, and every change refreshes the figures.
The remaining filters narrow down the grid without changing the period:
- Search: find a domain or customer by name.
- Customer and Region: focus on one client or one processing region.
- Compliance: show only domains in a band (95% or higher, 70 to 95%, below 70%, or No data).
- Domain Type: Standard or Parked. Parked rows also carry a blue "P" chip.
The headline tiles and the record counter at the bottom of the panel always reflect whatever you have filtered to, so you can use the filters to answer questions like "how compliant is this one customer over the last 90 days?".
Drilling into a domain and its sources
Click any domain name that has data to open its DMARC detail panel. This is where you do the real investigation. You will find a Compliance over time chart, a Geographic distribution heat map (switch between Volume and Failures), the TLS-RPT panel where it applies, and an optional AI analysis card that summarises the last 14 days (this uses Claude and spends one AI credit each time you run it).
The Sending sources table lists every IP address that sent mail as the domain in the period, along with its Country, a Source classification, the ISP or network it belongs to (its ASN), the message volume and the compliance. The Source column tells you who the IP belongs to: Business mail (your own systems), ESP (a third-party sending service such as a marketing platform), Forwarder (a service that re-delivers received mail), or Unknown when DMARCER cannot match it. The chips above the table (Source mix, Compliance, Message volume and Identification) let you filter the list quickly, for example to show only Unknown sources or only low-compliance ones.
Click a source row to expand the individual report records behind it. Each line is one receiver's daily summary (these reports group mail by day rather than listing each message), and it shows the report window, the organisation that sent the report, the volume, what they did with the mail, whether SPF and DKIM matched your From domain, the Header From, and the underlying authentication results, so you can see exactly why a source passed or failed.
Tagging an unknown source
When a legitimate sender shows up as Unknown, click the tag icon next to it to open Identify this source. Give it a Provider name, choose a Category (ESP, Business mail or Forwarder), and supply an ASN, an organisation regex (a text pattern that matches the organisation name), or both. If you give both, a source matches when either one matches. Once saved, that source is recognised by name across your account in future reports, which makes the table much easier to read over time.
Using reports to move towards enforcement
Before raising a domain's policy from none to quarantine or reject, work through its sources and make sure every legitimate sender is compliant (passing SPF or DKIM that matches your From domain). Anything genuine that is failing needs to be fixed first, usually by adding the sender to your SPF record or turning on DKIM signing for it. Sources you do not recognise that fail authentication are exactly what enforcement is meant to stop, so they are not a reason to hold back.
Common pitfalls
- "No data" or "No report data yet for this period": receivers send reports roughly once a day, and only after your DMARC record includes a reporting (rua) address, so a newly added domain will be empty for a day or two. Widen the period if you have only just started.
- Compliance is about matching your From domain, not just passing. A message can pass SPF at the sending service yet still be non-compliant if that pass does not line up with your From domain. The Aligned SPF and Aligned DKIM columns show you the difference.
- Forwarders often show SPF broken but DKIM aligned. That is perfectly normal: forwarding breaks SPF, so a valid DKIM signature is what keeps forwarded mail compliant.
- The geographic map can add up to less than the Messages figure, because some sending IPs cannot be placed on a map and are left off rather than guessed at.
- If you see an amber banner saying the regional report store could not be reached, the figures may be incomplete for that region. This is a temporary connection issue, not missing mail.
- These are aggregate (RUA) reports, which summarise volumes and outcomes. They do not include message-level detail such as subjects or recipients; that lives in forensic (RUF) reports on the separate Forensic page, which has its own access permission.