What information is contained in DMARC RUA and RUF reports?
Matthew Whittaker
Co-founder & CTO, Suped
Published 12 Jun 2025
Updated 17 Aug 2025
8 min read
Understanding what is contained within your DMARC reports is fundamental to achieving robust email security and optimizing deliverability. DMARC (Domain-based Message Authentication, Reporting, and Conformance) provides two main types of reports: RUA (Aggregate) and RUF (Forensic). These reports are invaluable for gaining visibility into how emails sent from your domain are being authenticated and handled across the internet.
While both report types serve the purpose of providing feedback on email authentication, they differ significantly in their level of detail and the specific information they convey. Properly analyzing these reports allows you to identify legitimate email sources, detect unauthorized use of your domain (spoofing), and troubleshoot authentication issues that might impact your email deliverability. Without this data, it's virtually impossible to move your DMARC policy to an enforcement level, leaving your domain vulnerable to abuse.
Let's explore the distinct information each type of DMARC report provides and how this intelligence can empower you to maintain a healthy email ecosystem. Gaining insight into these reports is a cornerstone of effective email deliverability strategies.
DMARC RUA reports, also known as aggregate reports, provide a high-level overview of all email traffic originating from your domain. These reports are sent to the email address specified in the rua tag of your DMARC record. They are typically generated daily by receiving mail servers and are sent in XML format. While the XML can be dense, it contains crucial data that helps you understand your email sending landscape.
The primary goal of RUA reports is to provide statistical information without exposing sensitive details. This means they generally do not contain personally identifiable information (PII) such as the exact recipient email addresses or the content of the emails. Instead, they focus on the authentication status of messages. You can learn more about how these reports work and why they are important for DMARC by checking out this article on DMARC.org.
Key information you can expect to find in a DMARC RUA report includes:
Reporting organization information: Details about the mail server generating the report (e.g., name, email address, report ID).
Date range: The period for which the data is aggregated.
Policy published: Your domain's DMARC policy (p=none, p=quarantine, or p=reject) as seen by the reporting organization, and any sp (subdomain policy) tag.
Source IP addresses: The IP addresses of servers that sent emails claiming to be from your domain, grouped together.
Volume of mail: The number of messages observed from each sending IP address.
Authentication results: Whether messages passed or failed SPF and DKIM checks, and importantly, if they achieved DMARC alignment.
Policy applied: The action taken by the receiver based on your DMARC policy (e.g., none, quarantine, reject).
Header from domain: The From: domain in the email header.
DMARC RUF reports (forensic reports)
DMARC RUF reports, also known as forensic or failure reports, offer a much more granular view of individual messages that fail DMARC authentication. These reports are intended to provide detailed insights into why a specific email failed, which can be invaluable for forensic analysis of spoofing attempts. They are sent to the email address specified in the ruf tag of your DMARC record.
Unlike RUA reports, RUF reports can potentially contain sensitive information because they provide details about individual messages. This may include:
Full message headers: Including the sender, recipient, subject line, and other routing information. This can sometimes (depending on the reporting ISP) show the envelope_to and envelope_from domains or even the recipient email address.
Original message body: Though often redacted or truncated due to privacy concerns, it can theoretically be included.
URLs and attachments: Pointers to URLs or information about attachments in the failed email.
Delivery result: Details on why the email failed DMARC and how the receiving server handled it.
Sender IP information: The specific IP address that sent the non-compliant email.
Due to the sensitive nature of the information that can be included in RUF reports, and potential privacy implications (e.g., GDPR), very few mailbox providers actually send these reports. While they offer deep insights for security teams, their practical use is limited by their scarcity. It's important to understand whether RUA and RUF tags are mandatory for compliance.
Differences and data privacy
The fundamental difference between RUA and RUF reports lies in their purpose and the level of detail they provide. RUA reports are about aggregate statistics and trends, helping you see the broader picture of your email traffic and authentication success rates. RUF reports, on the other hand, are designed for pinpointing specific failures and understanding the exact nature of an authentication issue or a spoofing attempt on an individual message basis.
While RUF reports promise rich forensic detail, their privacy implications have largely led to their discontinuation by most major mailbox providers. This makes RUA reports the workhorse for DMARC monitoring. Most organizations rely exclusively on aggregate reports to monitor their email sending practices and enforce their DMARC policies. You can find more information about the differences, including potential privacy concerns, on Fortra's email security blog.
RUA report characteristics
Data type: Aggregated, statistical summaries.
Purpose: Broad overview of authentication trends and domain usage.
Privacy: Generally privacy-friendly, no PII (with some exceptions like Microsoft reports that include envelope domains).
Format: XML.
Frequency: Typically daily.
RUF report characteristics
Data type: Individual message samples.
Purpose: Deep forensic analysis of specific email failures or attacks.
Privacy: Contains sensitive information (headers, potentially body/URLs), raising privacy concerns.
Format: AFI (Authentication Failure Reporting) format, often containing full email content or headers.
Frequency: Sent immediately upon failure, but very rarely sent by providers.
Given the privacy considerations and the practical reality that few organizations send RUF reports, most DMARC implementations focus primarily on leveraging the insights from RUA reports. Utilizing a robust DMARC report analysis tool is key to transforming these complex XML files into actionable intelligence.
Leveraging DMARC reports for domain protection
Despite the differences, both RUA and RUF reports (when available) are critical for effective DMARC implementation. RUA reports give you the continuous feedback loop needed to understand your overall email authentication health, identify legitimate sending sources that might not be correctly authenticated, and detect widespread unauthorized use of your domain.
Monitoring RUA reports is an ongoing process. You'll use them to ensure all your legitimate email senders are properly configured with SPF and DKIM and that their emails are DMARC aligned. This helps in transitioning your DMARC policy from p=none to p=quarantine or p=reject, effectively protecting your domain from phishing and spoofing. Without this visibility, moving to an enforcement policy is risky, as it could lead to the rejection of your legitimate emails.
For instances where RUF reports are received, they offer a deeper dive into specific email failures. While rare, these reports can provide detailed evidence of malicious activity, allowing security teams to analyze the attack vectors and improve their defenses. Their scarcity highlights the importance of maximizing the utility of RUA reports for proactive domain management and blacklist monitoring.
Configuring DMARC records for reporting
To receive DMARC reports, you need to include the rua and optionally the ruf tags in your DMARC DNS record. These tags specify the email addresses where reporting organizations should send the aggregate and forensic reports, respectively.
Remember that the email address for receiving reports should typically be within the same organizational domain or have a properly configured DNS record allowing cross-domain reporting. For a list of all DMARC tags and their meanings, refer to our guide to DMARC tags.
Views from the trenches
Best practices
Actively monitor DMARC RUA reports to identify all legitimate sending sources and ensure their authentication is properly configured.
Use a DMARC analysis platform to visualize and interpret aggregate report data, making it easier to spot trends and issues.
Regularly review your DMARC policy based on report insights, gradually moving towards stricter policies (quarantine/reject) as your domain’s email streams become compliant.
Common pitfalls
Ignoring DMARC reports or not having a process to analyze them, which leaves your domain vulnerable to spoofing.
Expecting frequent RUF reports for forensic analysis, as most mailbox providers (like Gmail) rarely send them due to privacy concerns.
Setting a DMARC enforcement policy (p=quarantine or p=reject) without first monitoring RUA reports, risking legitimate email blocking.
Expert tips
Focus on mastering RUA report analysis first, as it provides the most actionable data for most DMARC deployments.
Remember that Microsoft RUA reports can include envelope domains, providing slightly more detail than others.
Automate DMARC report parsing and alerting to quickly react to any suspicious activity or authentication failures.
Marketer view
Marketer from Email Geeks says DMARC reports do not contain the content of an email, and while it might be possible to discern the recipient, RUA reports are generally designed to protect recipient privacy.
2024-02-05 - Email Geeks
Expert view
Expert from Email Geeks says that Microsoft RUA reports are unique in including the envelope_to and envelope_from domains, though not the local parts of addresses, in their identifiers section.
2024-02-05 - Email Geeks
Final thoughts on DMARC reporting
DMARC RUA and RUF reports provide distinct but equally important insights into your email sending practices and domain security. While RUA reports offer the necessary aggregate data for ongoing monitoring and policy enforcement, RUF reports, though scarce, can offer deep forensic detail when available. The key to successful DMARC implementation lies in understanding the information each report provides and leveraging it to continuously improve your email authentication posture.
By actively monitoring your DMARC reports, you can gain confidence that your legitimate emails are reaching their intended inboxes while simultaneously protecting your brand from phishing and spoofing attacks. This proactive approach is crucial for maintaining a strong sender reputation and ensuring optimal email deliverability.
Microsoft reports that include envelope domains).
