DMARC aggregate report

A DMARC aggregate report summarises a receiving mail system’s observations about message streams for a domain. The XML report contains information about policy, authentication and reported volumes within a period. It is not a list of read messages.

Investigate an unusual source

In the fictional design, a team analyses report B-660. A sending source that has not yet been identified shows failed checks. The team compares it with the portal and support services actually used. The finding may concern a forgotten legitimate source; it is not automatically evidence of abuse.

For the investigation, the reporting period, reporting system, observed source and check results are considered together. The report describes that reporting system’s view. A gap in received reports must therefore not be interpreted as proof that no further sending occurred.

Feed findings back into configuration

Assign a responsible party to identified sources and check necessary changes using suitable test cases. An aggregate authentication finding does not replace delivery evidence for an individual message. A positive finding does not show whether it was in the inbox or was read either.

Sources

• IETF: DMARC Aggregate Reporting