Receive and read DMARC reports

Every day, Gmail, Outlook, Yahoo and the other mailbox providers can tell you which servers sent mail in the name of your domain, and whether that mail passed SPF and DKIM. These DMARC aggregate reports are XML files that nobody wants to read by hand. From the Solo plan, Perimetry Cloud receives and reads them for you.

Turn the reports on

1. Open the page of a proved domain and find the DMARC reports card.
2. Press Receive DMARC reports (owners and admins). The card gives the address reserved for this domain, of the form dmarc+…@perimetry.cloud.
3. Publish the DMARC record shown in the card. It is built from your current record, so nothing in it is lost: our address is added to its rua= tag, next to any address you already use. If no audit has read your record yet, run one first, or add the address to the rua= tag yourself.
4. Wait a day or two. The providers send their reports once a day, for the day before, as soon as your record has the address.

With the reports on, the DMARC records offered under your findings also carry the address.

Read the reports

The card sums up the last 30 days: the share of messages that passed DMARC, and how many reports arrived from the large providers. Senders and details opens the full page:

• Period: the last 7, 30 or 90 days.
• Reporters: Large providers (Google, Microsoft, Yahoo), whose reports nobody else can fake, or All reporters, which adds the others whose sending domain was proved by DKIM.
• Senders: each sender in your name with its messages, how many passed DMARC (SPF or DKIM aligned), the servers it used, and how many messages the receivers sent to spam or rejected. Senders with failing mail are highlighted.

A sender is the domain that signed the mail (DKIM), otherwise the domain of its envelope (SPF), otherwise its address.

What to do with a failing sender

• A service you use (newsletter tool, invoicing, help desk…): add it to your SPF record, or set up DKIM in that service.
• A sender you do not know: someone is using your name. That is exactly what a stricter DMARC policy stops. Mark it Not mine in the DMARC step by step card.

Stop the reports

Stop receiving reports turns the address off at once; the reports already read are kept. Remove our address from the rua= tag of your record as well. If your plan no longer includes DMARC reports, new ones are received but no longer read until you turn them off or choose a plan that includes them.

TLS reports

The same plans can also receive TLS reports (TLS-RPT): the servers that send you mail say every day how many of their connections to your mail servers were encrypted, and why the others failed (an expired certificate, a name that does not match, no STARTTLS, an MTA-STS or DANE problem). Follow the TLS reports (TLS-RPT) link in the DMARC reports card:

1. Press Receive TLS reports (owners and admins, on a proved domain).
2. Publish the _smtp._tls record shown. It replaces any _smtp._tls record you have, since a domain has only one.
3. The first reports arrive a day or two later. The page then shows, over 7, 30 or 90 days, the sessions that succeeded and failed, each reporter, and why sessions failed, mail server by mail server, each reason in plain words.

A report sent over HTTPS cannot prove who sent it, so its sender is shown as it names itself. Stop receiving TLS reports turns the address off at once; the reports already read are kept.

Privacy

Reports are read as soon as they arrive, and the raw message is then erased. A report that does not concern the domain it was sent for is set aside. The address of a domain stops working if the domain loses its ownership proof.

To read a single report without an account, use the free DMARC report reader, which works entirely in your browser.