What Is a DMARC Aggregate Report?
TL;DR
A DMARC aggregate report is an XML file a receiving provider sends to the address in your rua tag, summarising the mail it saw claiming to come from your domain and how each source performed against SPF, DKIM and alignment. Reports normally cover one day and arrive compressed.
How do you start receiving aggregate reports?
Add a rua tag to the DMARC record, as in v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com. Nothing else has to change, and a policy of none still produces the full report stream, which is why monitoring is the first step of any rollout.
The reporting interval is set by the ri tag and defaults to 86400 seconds, so one report per receiving provider per day is the normal cadence. Reports arrive as XML and are usually gzip compressed, which is why the raw attachments are hard to read by eye.
What is actually in the report?
Counts grouped by sending IP address rather than individual messages. For each source you get how many messages it sent, the SPF and DKIM results, whether either result aligned with your From domain, and which policy the receiver applied.
What it does not contain is content: no subjects, no recipients, no bodies. That is the trade which makes the reports safe for a provider to send, and it is why they show you sources rather than incidents.
Why does the report stream matter before you enforce?
Because it is the only inventory of who sends as your domain. A sending platform added years ago, a ticketing system, an invoicing tool, a partner sending on your behalf, all of them show up here and nowhere else.
That inventory is what makes moving to quarantine and then reject safe. Every source you recognise gets authenticated first, and only when nothing legitimate is failing does tightening the policy stop hurting your own mail.
Frequently asked questions
The rua tag receives aggregate reports, the daily statistical summary. The ruf tag requests failure reports about individual messages, which carry far more detail and are consequently sent by very few providers because of the privacy exposure.