[ Reports & investigation ]
How to read a DMARC aggregate report and decide what needs attention
Read the reporter and period, distinguish raw authentication from aligned results, and prioritise verified business services rather than treating one pass percentage as the whole story.
By the EmailAuth research team · 7 min read
[ Key points ]
- Read raw authentication, alignment and disposition separately.
- State the denominator behind every percentage.
- Prioritize critical legitimate failures over headline pass rates.
[ Takeaway ]
Prioritize critical legitimate failures over headline pass rates.
[ By role ]
What this means for you
Choose your role for practical next steps.
IT / Mail Admin
Read the evidence in its separate layers.
Retain reporter, period, policy context and source provenance. Compare auth_results with aligned policy_evaluated fields, then correlate material rows with original messages and service configuration.
Next steps
- Handle duplicate and overlapping observations under a documented rule.
- Keep disposition separate from pass and inbox placement.
- Verify a correction on the real route and subsequent observations.
CISO / SecOps
Review coverage, confidence and data handling.
Participating receiver reports are not a complete sent-mail ledger. Require honest coverage statements, accountable remediation and protected ingestion of potentially forged or malformed input.
Next steps
- Ask how approved-service attribution was established.
- Review access, provenance and parser resource limits.
- Record uncertainty and the business impact of unresolved findings.
Founder / Non-technical
Ask whether the important communications work.
A high pass rate can hide a completely failing password-reset service. Ask which business workflows are represented and which have unresolved delivery or authentication issues.
Next steps
- Request the denominator behind each percentage.
- Ask who owns the critical legitimate failures.
- Keep unknown traffic separate from confirmed abuse.
[ FAQs ]
Frequently asked questions
Does a DMARC report list every message my organisation sent?
No. It contains grouped observations from a reporting receiver over a stated period. Reporting participation and other population differences limit coverage.
Why can auth_results show SPF pass while policy_evaluated shows SPF fail?
The underlying SPF check can pass for an envelope domain that does not align with the visible From domain. Read the raw and aligned layers separately.
Does disposition none mean the message passed DMARC?
No. Disposition and aligned authentication results are separate fields. Interpret the report format, policy context and any local handling information.
Can I identify an approved sending service from source_ip alone?
Not reliably. Shared infrastructure and intermediaries can obscure the responsible application. Correlate messages, customer-specific configuration and a business owner.
Which denominator should I use for a pass rate?
State the purpose and population explicitly, such as all observed report traffic or investigated legitimate streams. Neither should be silently presented as every message sent.
Are all unknown failures attacks?
No. Unknown means attribution is unresolved. Legitimate applications, indirect routes and configuration problems can appear alongside unauthorised use.
Why can a report describe an older policy than my DNS lookup?
It describes an earlier reporting interval and the receiver's observations. Preserve configuration history and time boundaries instead of assuming the current record was always in effect.
[ Sources ]
Sources
[ Glossary ]
Glossary
- Aggregate report
- Grouped observations from a reporting receiver for an interval, not a complete sent-mail ledger.
- Alignment
- The required domain relationship between the visible From and an authenticated SPF or DKIM identity.
- Disposition
- Reported DMARC-related handling, distinct from proof of inbox placement.
- Provenance
- The source and processing history retained with an observation.
Enterprise provenance
Why top financial institutions and governments retired their email security dashboards.
Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.
EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.
SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption