Understanding, Configuring and Analysing DMARC Reports

This article explains how DMARC reports work, focusing in particular on parameters such as rua (Reporting URI for Aggregate reports) and ruf, as well as the implications of configuring them.

Introduction

You have carefully configured your SPF and DKIM records, your email logs show that your messages are being delivered successfully, and yet some of your contacts claim they never receive your emails or find them in their spam folders.

This situation can be particularly frustrating: everything seems perfect on your server, but the final delivery fails without you knowing why.

This is precisely where DMARC reports come into play. They act as the “black box” for your mailings, giving you complete visibility into how major providers (Gmail, Outlook, Yahoo, etc.) handle your emails.

Note : The Glossary contains explanations on multiple topics and can be consulted to clarify certain terms.

What is a DMARC Report?

DMARC reports are automated health checks generated by the servers that receive your emails. They contain crucial information on the following points.

• The authenticity of your mailings. Have remote servers validated or rejected your SPF and DKIM configurations?
• The sending sources. Which third-party servers or services (such as newsletter tools, CRMs, billing platforms or, unfortunately, hackers) are sending messages using your domain name?
• Spoofing attempts. Whether malicious servers are attempting to send fraudulent emails (phishing) by impersonating you.

By analysing these reports, you will discover exactly what is going wrong with your email delivery and can adjust your settings to ensure your legitimate emails reach their destination.

Data Privacy and Security

DMARC reports contain detailed technical information about your email traffic, including IP addresses, header structures and potentially sensitive data regarding your sending patterns.

• Restricted access. Access to the dedicated reporting mailbox should be restricted solely to relevant and technically competent individuals within your organisation.
• Impact of third-party tools. Submitting these files to external platforms or analysers involves sharing this email data with a third party.
• Trusted tools. Ensure you choose reputable solutions with strict privacy policies that comply with data protection regulations (such as the GDPR or Bill 25), to ensure your information is not exploited or resold.

Prerequisites

Enabling DMARC reports requires some preparation. By default, these reports are sent as raw data files (XML). If you configure them to be sent to your main email address, your inbox will quickly become overwhelmed with unreadable messages. Please also note that the N0C platform allows you to configure the transmission of these reports via your DNS zone, but does not provide an internal portal for viewing or analysing them.

Enter the following address into your web browser: https://mg.n0c.com/en/.

Procedure

Step 1 — Set up a Dedicated Email Address for Reports

Enabling DMARC reports will prompt email servers around the world to send you tracking data automatically. If you use your main email address, your inbox will quickly become flooded with technical messages that are difficult to read on a daily basis.

This is why it is essential to create an address dedicated solely to receiving this data (for example: reorts-dmarc@yourdomain.com). This will allow you to centralise the information in one place without disrupting your professional or personal communications.

To create this email account, you will need to carry out the following two steps.

1. Log in to your N0C control panel and go to the Email -> Email Accounts section.
2. Create your new inbox by following the instructions detailed in our dedicated guide (please refer to the section How to Create a New Email Account in the article How to Manage Email Accounts).

Step 2 — Draw Up Your Approach and Choose Your Options

Implementing DMARC reports should not be done haphazardly. It is a strategic process that should be planned in stages.

Before making any changes to your DNS zone, you need to understand the options available to you so that you can draw up a plan for a gradual and secure rollout. The aim is to secure your domain without accidentally blocking your own legitimate emails.

Main Parameters

Here are the main settings (known as tags) that you will need to configure.

• The security policy (p=...). This is the main instruction given to the servers that receive your emails. It has three levels.
  • none (observation): remote servers process your emails normally, at their discretion. This is where it all begins, and it is the default setting on N0C.
  • quarantine (quarantine): emails that fail the checks are sent directly to your recipients’ junk mail (spam) folder.
  • reject (reject): unauthenticated emails are simply blocked and deleted by the receiving server.
• The application percentage (pct=...). This setting (from 0 to 100) tells servers what proportion of your messages the policy (quarantine or reject) should apply to. For example, p=quarantine; pct=20; means that only 20 % of suspicious emails will be quarantined, allowing you to test the configuration gradually.
  • Unfortunately, the application percentage is not always respected by remote servers; this must therefore be taken into account.
  • The long-term goal is 100 %. The aim is therefore to remove the application percentage.
• The reporting addresses (rua and ruf).
  • rua (Aggregated reports): highly recommended. The report sends a daily summary in XML format containing statistics on your sending volumes and their authentication status.
  • ruf (Analytical reports): to be used with caution. The report sends a detailed email in real time whenever a single message fails. As this generates a considerable volume of emails, the address is often blocked by providers such as Gmail, for privacy reasons.

Recommended Deployment Strategy

To avoid any disruption to your services, we recommend following this step-by-step approach over several weeks or even months:

1. Phase 1 (monitoring). Configure DMARC to p=none with your rua record. Read and analyse your reports for at least 2 to 4 weeks to identify all your legitimate sending tools (CRM, billing tools, etc.) and correct their SPF/DKIM configurations where necessary.
2. Phase 2 (gradual quarantine). Switch to p=quarantine with a low percentage (example: pct=10), gradually increasing it to pct=100 as you validate the compliance of your mailings, ultimately removing the application percentage.
3. Phase 3 (maximum protection). As soon as you are certain that 100 % of your legitimate mail flows are fully authenticated, switch to p=reject to permanently block spammers.

Step 3 — Adding the DNS Entry

Set Up Your DMARC Record

Your record takes the form of a single line of text combining the tags selected in the previous step, separated by semicolons.

Here is an example configuration for an observation phase (recommended initially): v=DMARC1; p=none; rua=mailto:reports-dmarc@yourdomain.com;

If you were at a more advanced stage (for example, in progressive quarantine), the value would look more like this: v=DMARC1; p=quarantine; pct=50; rua=mailto:reports-dmarc@yourdomain.com.

Go to Your DNS Zone Management

The location where you need to add this line depends on the configuration of your name servers (NS).

• If your domain uses N0C’s name servers. Log in to your N0C control panel, then navigate to Domains -> Domain Management. Find your domain in the list, click on the three dots and select DNS.
• If your domain uses third-party name servers (e.g. Cloudflare, another registrar). You must carry out the procedure directly on their platform, referring to their respective documentation.

Create or Edit the DNS Entry

DMARC is always applied to a specific subdomain that must be named _dmarc.

• If you already have an entry for _dmarc. Simply replace its existing value with your new configuration line.

• If no record exists. Create a new record with the following settings:
  • Name / Host: _dmarc (or _dmarc.yourdomain.com);
  • Type: TXT; and
  • Value / Target: enter the configuration string you created in step 1.

For step-by-step guidance on the visual interface for editing zone files, please see our article How to manage DNS.

Step 4 — View and Analyse Your Reports

Once the DNS record is active, remote servers will start sending reports to the dedicated email address you created in Step 1 (usually within 24 to 48 hours).

As mentioned in the prerequisites, these files arrive in raw compressed XML format (.zip or .gz). They are designed to be read by machines, not humans. To analyse them easily without any programming knowledge, you will need to use a reader or an external analysis platform.

Option A — Use a Free DMARC XML Parser (Quick Analysis)

If you receive a low volume of emails and simply want to check a report from time to time, you can manually upload your XML files to free online viewers. These tools instantly convert the code into readable tables and graphs.

Examples include:

• MxToolbox DMARC Delivery Report. Allows you to copy and paste the XML content or upload the file for an immediate analysis.
• DMARC Analyzer (or similar tools). Offer quick, no-obligation viewing options.

Option B — Use a Monitoring Platform (Recommended For the Long Term)

If you manage multiple domains or send large volumes of emails, the manual approach will quickly become tedious. It is more efficient to automatically forward your reports to a specialist service that will centralise and externalise your data in an interactive dashboard.

Among others:

• DMARCian. One of the most popular platforms. It offers a free trial and plans to track the progress of your compliance over the weeks.
• Postmark DMARC Monitoring. An excellent service (with a very generous free offer) that sends you a clear, easy-to-understand weekly summary by email, saving you from having to analyse the XML yourself.

How does it work? These platforms will provide you with a personalised receiving address (e.g. uniquekey@ag.dmarcian.com). All you need to do is edit your DNS entry in Step 3 to replace your address with theirs, or set up an alias to automatically redirect or forward emails from your rapports-dmarc@votredomaine.com mailbox to their tool.

Please Note: If You Centralise Reports on Another Domain

If you decide to send reports from domainA.com to an address on another domain that you own, such as domainB.com (e.g. rua=mailto:rapports-dmarc@domaineB.com), the remote servers will refuse to send the data for security reasons and to prevent spam.

To authorise this transfer, you must add a TXT DNS record on the domain that receives the reports (domainB.com):

• Name / Host: domainA.com._report._dmarc.domainB.com.
• Type: TXT.
• Value / Target: v=DMARC1.

Specialised platforms such as DMARCian or Postmark handle this authorisation automatically on their own servers; so you do not need to do anything if you use their custom addresses.

Conclusion

Setting up DMARC reports is the best way to shed light on the mysteries of your email delivery.

By switching from a passive monitoring mode (p=none) to active, progressive protection, you not only safeguard your company’s reputation against spoofing, but also ensure that your legitimate messages reach your customers’ inboxes.

Take the time to analyse your initial reports over a few weeks before tightening your security policy. A clean and monitored DNS configuration is the key to reliable and professional email communication.