DMARC reports
DMARC lets other mail providers check whether a message claiming to be from your domain is genuine, and tells them what to do with it if it is not. A DMARC aggregate report is the feedback those providers send back: a periodic summary of every message they saw "from" your domain, whether it passed the checks, and what they did with the ones that did not. Reading these reports is how you find out both whether your own outgoing mail is authenticating correctly, and whether someone else is sending forged mail that pretends to be from your domain (a common setup for phishing).
Where the reports come from
When a domain has a mailbox set up, we publish a DMARC DNS record for it that tells other mail providers to send their aggregate reports to a dedicated dmarc@ mailbox on your own domain. That mailbox exists only to collect these reports – it is not shown in your mailbox list and is not meant for regular mail. We read that mailbox in the background and turn each report into an entry in the list below; you never need to open it yourself. The DMARC record itself is part of your domain's DNS – see DNS records for what it looks like and Editing DNS records if you ever need to change it by hand.
The report list
Open DMARC Reports for a hosting in https://panel.cloudweb.sk to see every report received for that hosting's domains. If the hosting has more than one domain with e-mail, a Domain filter narrows the list to one of them. Each row shows:
- Domain – which of your domains the report is about.
- Organization – the mail provider that sent the report (for example a large webmail provider that received mail claiming to be from your domain).
- Period – the date range the report covers.
- Records – how many distinct sending sources the report lists.
- Result – a pass/fail count, showing how many of those records passed both DKIM and SPF and how many did not.
Open Detail on a row to see the full report.
Reading a report detail
The detail page shows the total number of records, how many passed both DKIM and SPF, and how many failed at least one. Below that is a table with one row per sending source:
- Source IP – the server that actually sent the mail, as seen by the reporting provider.
- Count – how many messages from that source are covered by this row.
- Disposition – what the reporting provider did with mail from that source based on your domain's DMARC policy: delivered normally, sent to spam/junk, or rejected outright.
- DKIM and SPF – pass or fail for each check, with the domain that check was evaluated against.
- Header From – the domain shown in the message's visible "From" address.
A source you recognise (our mail server, or a marketing/invoicing tool you actually use to send as your domain) failing DKIM or SPF is a configuration issue worth fixing. A source you do not recognise sending mail "from" your domain and failing both checks is exactly what DMARC is meant to catch – it means someone else is trying to send forged mail using your domain's name, and because of your DMARC policy the receiving provider did not deliver it as genuine.
When a legitimate sender fails
The most common false alarm is a real service you use – a mailing-list tool, an invoicing or CRM system, a contact-form plugin – sending mail with your domain in the "From" address without being authorised to do so in your DNS. Fix it by either adding that service's sending servers to your domain's SPF record, or setting up DKIM signing for it if the service supports it, then adding the DKIM record it gives you. Both are done in Editing DNS records; see DNS records for what the SPF and DKIM record types do. Simpler alternative for many services: send from a mailbox that actually belongs to your domain instead of spoofing your domain's address from the third-party service.
How current the data is and how far back it goes
New reports are picked up in the background roughly once an hour. How often a report itself arrives depends entirely on the mail provider that sends it – it is not something we control. Reports and their records older than 90 days are removed automatically.
Who can see these reports
The hosting's owner and anyone added as a collaborator on that hosting can open DMARC Reports. Each hosting only ever shows reports for its own domains.
Related
For your own mail's send/receive activity rather than what other providers report about it, see Delivery logs and auth logs. Managing the mailboxes DMARC reports about is covered in Mailboxes.
Was this article helpful?
Your feedback helps us improve our documentation