Once you publish DMARC with a rua address, receiving providers send you aggregate reports, usually daily, as compressed XML files. They're not meant for people to read directly, but the content is simple.
What a report tells you
- Who reported it: the provider that received your mail.
- Source IP: the server that sent it.
- Count: how many messages came from that server.
- DKIM and SPF results: whether each passed and aligned with your domain.
- Disposition: what the provider did with the mail.
Three things to look for
- Your own tools failing. A real service that doesn't align needs SPF or DKIM set up for your domain.
- Senders you don't recognize. They may be a forgotten tool, or someone spoofing you.
- Forwarding noise. Forwarded mail often fails SPF. That's normal if DKIM still passes.
Make them readable
A free report parser turns the XML into a table. Send reports to a dedicated mailbox, since they pile up.
When to change your policy
Google doesn't give a fixed monitoring period. Move from p=none only when the reports show your legitimate mail passing.