[ Troubleshooting & reporting ]
Reporting and investigation
Turn RUA aggregate and RUF forensic reports into decisions: find every sender, spot abuse and prove progress.
63 guides
[ Core guides ]
[ All guides ]
Article
Decoding DMARC Forensic Reports: Insights into Failing Domains and Their Causes
Learn about DMARC Forensic reports and gain valuable insights into failing domains and their causes.
Article
Mastering DMARC Reports: A Comprehensive Guide to Understanding and Analysing DMARC Data.
Protect your business from email fraud and phishing with DMARC. Learn how to set it up and analyse its reports with this comprehensive guide. Master DMARC data and improve your email security today!
Article
The Significance of the DMARC RUA Tag in Email Security
Learn about the importance of the DMARC RUA tag in email security and protecting your business from email spoofing and phishing attacks. Read now!
Article
DMARC RUF Reports: Understanding Failures and How to Improve Email Security
Learn how to improve your email security by understanding DMARC RUF reports and their failures. This blog post provides valuable insights on how to identify and address DMARC RUF failures
Article
Decode DMARC Summary Emails like a Pro: The Ultimate Guide to Understanding DMARC Reports
Discover the key metrics to understand the effectiveness of your DMARC policy and identify unauthorised senders using your domain. Read now!
Article
Maximizing Your Email Security: Actionable Steps to Take After Collecting DMARC Data
DMARC data is a powerful tool for securing your email. Learn how to take actionable steps to protect your organization from cyber threats.
Article
Maximizing Your DMARC Data: Essential Steps to Take After Collection for Better Email Security
Are you curious to learn how to optimize your DMARC data? This guide provides essential steps to take after collection for better email security.
Article
Understanding RUF: What is it and how it can benefit your email deliverability
Looking to improve your email deliverability? Learn about RUF and its benefits in this informative guide.
Article
A Comprehensive Guide to Explaining a DMARC Report.
Know more about email security by setting up a DMARC report. Our guide walks you through the entire process to ensure your data remains safe.
Guide
A reported IP is not an approved sending service
Trace a reported source IP to a service decision without confusing connecting infrastructure, authentication alignment and customer-specific approval.
Guide
Avoid false attribution on shared mail infrastructure
Keep shared IP infrastructure separate from customer accounts, signing identities and business approval when investigating email-authentication observations.
Guide
Build a sender-level investigation timeline from report and DNS evidence
Build a time-based authentication investigation that preserves report windows, DNS history, individual tests and unresolved causes.
Guide
Choose useful denominators for DMARC metrics
Define DMARC metric scope, counting units, legitimate cohorts and zero-observation handling before comparing percentages.
Guide
Deduplicate DMARC reports without discarding legitimate observations
Handle report replay, changed-content conflicts and partial overlap with preserved evidence and a reversible counting policy.
Guide
DMARC failure reports: availability, usefulness and limitations
Use message-specific reports as optional, sensitive diagnostic evidence rather than a complete feed of authentication failures.
Guide
DMARC metrics a CISO can use to assess control coverage
Separate domain deployment, observed authentication and critical-service coverage with reproducible metrics and visible exceptions.
Guide
DMARC reporting latency: separate delayed evidence from a current outage
Measure report receipt and processing delays separately, preserve observation intervals and use current evidence for live mail incidents.
Guide
DMARC reporting privacy: decide what you need to collect
Separate aggregate observations from failure reports and uploaded message samples, then define access, processing and retention for each purpose.
Guide
DMARC XML structure: map fields to an investigation
Read the report hierarchy before turning a row into a DNS change.
Guide
DNS changes during a reporting window: preserve the historical context
Interpret reports across DNS policy changes using dated configuration evidence, cache limits and distinct authentication and handling results.
Guide
Encrypted failure reports and recipient-side handling
Separate transport encryption, message encryption and storage protection when designing a safe failure-report intake.
Guide
Export authentication data with provenance and reproducible definitions
Create reproducible authentication exports with scope, raw fields, source references, transformation versions and controlled evidence access.
Guide
External report authorisation: publish the receiving-domain permission correctly
Construct the external DMARC reporting authorization name from the retrieved policy domain and destination host, then verify the receiving domain’s permission.
Guide
Find the business owner of an unknown sending stream
Investigate an unknown sending stream through account, purpose and owner evidence while keeping the service register, last test and approval status explicit.
Guide
Geographic DMARC maps: explain what location data cannot prove
Interpret geographic report enrichment as uncertain infrastructure context, not attacker location, ownership or authorization.
Guide
Handle incomplete, malformed and inconsistent DMARC reports
Handle malformed and inconsistent DMARC reports with bounded parsing, provenance-aware quarantine and explicit recovery decisions.
Guide
How to read a DMARC aggregate report and decide what needs attention
Separate raw authentication, aligned results and disposition in DMARC reports. Prioritise critical business mail and retain attribution uncertainty.
Guide
Interpret ASN, reverse DNS and geolocation clues
Use registration, routing, PTR names and geolocation as bounded infrastructure clues without claiming application ownership, person location or sender approval.
Guide
Interpret authentication failures for an already approved sender
Classify authentication failures for an approved sender using route ownership, aligned identities and report provenance rather than an allowlist label.
Guide
Interpret DMARC disposition and local-policy overrides
Separate authentication, alignment and reported disposition; interpret override reasons without implying inbox placement or business approval.
Guide
Investigate 1e100.net in authentication reports
Use a Google infrastructure label as a starting clue, then verify the message identity, route and actual service owner.
Guide
Investigate a sudden DMARC failure spike
Investigate report quality, sender ownership, aligned authentication and actual business impact before responding to a DMARC failure spike.
Guide
Investigate security-gateway infrastructure appearing as a sending source
Trace the gateway route and signing boundary before changing authentication or treating a security appliance as the original sender.
Guide
Low-volume domains: interpret sparse reporting carefully
Interpret low-volume DMARC reporting using visible counts, weighted rates, actual workflow tests and clear coverage limits.
Guide
Multiple RUA destinations: understand duplication and delivery expectations
Compare multiple DMARC report destinations using matched arrivals, destination permission and raw observations without double counting.
Guide
No DMARC reports arriving: trace the collection path
Separate the reporting request, destination permission, mail delivery and ingestion stages before deciding what silence means.
Guide
Overlapping reporting windows and inconsistent reporter identifiers
Handle report overlap and inconsistent reporter labels with preserved provenance, explicit whole-report decisions and no invented unique totals.
Guide
Prevent XML entity expansion and archive-bomb problems in report processing
Test decompression and XML resource boundaries independently, using small safe fixtures and explicit recovery criteria.
Guide
Prioritise sender problems by business impact and evidence
Prioritize legitimate sender problems using verified ownership, impact and evidence while keeping uncertain attribution explicit.
Guide
Published policy versus evaluated policy in a DMARC report
Separate the receiver’s observed policy, alignment results and handling decision.
Guide
Raw DKIM results versus aligned DKIM policy results
Interpret each DKIM signature’s domain, selector and result before determining aligned DKIM and the overall DMARC result.
Guide
Raw SPF results versus aligned SPF policy results
Compare raw SPF identity and pass results with DMARC alignment, including strict mode, relaxed mode and null reverse-path scope.
Guide
Read Envelope From, Header From and Envelope To in reports
Distinguish Header From, Envelope From and Envelope To while preserving missing fields, null reverse-path semantics and authenticated identities.
Guide
Report delivery failures caused by mail routing or filtering
Locate a missing aggregate report between DNS, SMTP receipt, quarantine and parsing.
Guide
Report identifiers, reporter names and reporting periods
Interpret report IDs, reporter context, epoch reporting periods, duplicate receipts and overlapping data with a reproducible inclusion policy.
Guide
Report totals versus sending logs: reconcile different populations
Reconcile sending logs and report observations with consistent units, coverage assumptions, explicit adjustments and honest residuals.
Guide
RUA and RUF: choose the reporting evidence your team needs
Choose aggregate and failure reporting according to the investigation and the data exposure.
Guide
Safe ingestion of compressed DMARC XML files
Separate attachment intake, bounded decompression, safe parsing and transactional import so one hostile report cannot corrupt analytics or exhaust the collector.
Guide
Seasonal sending changes: adjust investigation baselines
Compare seasonal mail with equivalent cohorts and visible counts so a large passing campaign cannot hide a critical-stream regression.
Guide
Separate forwarding, direct sending and suspected spoofing
Classify email routes using SPF, DKIM, ARC and trusted receiver evidence without treating forwarding failures or a valid ARC chain as an automatic sender verdict.
Guide
Separate reporting coverage from the total population of email sent
Measure DMARC reporting coverage without treating received aggregate rows as a census of every message the organization sent.
Guide
Set retention periods for authentication reports and investigation records
Design authentication-record retention around purpose, approved clocks, scoped holds, copy handling and truthful disposal evidence.
Guide
Share DMARC evidence with a vendor without disclosing unrelated traffic
Prepare a minimal vendor evidence package that preserves the authentication diagnosis without exposing unrelated traffic or unnecessary identifiers.
Guide
The fo tag and failure-report requests
Choose the intended failure-report trigger and keep it separate from the DMARC pass result, enforcement policy and aggregate reporting.
Guide
Translate authentication findings into an executive risk discussion
Translate authentication findings into supported business risks, explicit decisions and verification steps without inventing loss or causality.
Guide
Validate a DMARC parser using representative failure and edge cases
Use a versioned fixture matrix to verify semantic accuracy, resource limits, duplicate handling and safe recovery before trusting report-derived metrics.
Guide
What p=reject reporting still tells you after enforcement
Maintain reporting after a reject policy, investigate sender regressions and distinguish aligned evaluation from receiver handling.
Guide
Why a high DMARC pass rate can hide a failing legitimate service
Find small critical services hidden by high overall DMARC pass rates, with count-weighted metrics and route-specific investigation.
Guide
Why a RUF report can contain sensitive message information
Identify the content, identities and hidden destinations that failure reports may disclose before collecting or sharing them.
Guide
Why some receivers do not send the reports you expect
Investigate missing report coverage by checking requests, delivery, parsing and actual receiver evidence without inventing zero failures.
Guide
Wildcard external report authorisation: assess the trust boundary
Assess wildcard DMARC report authorization as a broad receiving-domain opt-in, with separate tenant controls, capacity limits and withdrawal evidence.
Related free tools
Enterprise provenance
Why top financial institutions and governments retired their email security dashboards.
Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.
EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.
SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption
[ More in Troubleshooting & reporting ]