DMARC Reporting

Included with every Email Authentication tier, Free included. Your tier sets how far back you can read: 14 days on Free, 3 months on Plus, 1 year on Premium, 3 years on Enterprise.

To look at any domain's published DMARC record without an account, use the free DMARC Inspector.

1. What This Feature Does

DMARC Reporting publishes your domain's DMARC record and reads the reports receivers send back about it. Once a day, mailbox providers that handled mail claiming to be from your domain send a summary — how many messages, from which servers, and whether each passed SPF and DKIM. CertaDNS receives those reports for you and turns them into:

• What happened to your mail — delivered, quarantined or rejected, and whether your policy was enforcing it.
• Who sends as you — recognised sending services with their pass rates, and every unrecognised source listed by IP address.
• Why mail fails — SPF and DKIM results with alignment, per domain.
• Where it comes from — a map of sending countries.
• Individual failed messages, if you turn on forensic reports.

2. When You Should Use It

• You want to know every service and server sending mail as your domain, including the ones nobody told you about.
• You are at p=none and need evidence that your own mail passes before moving to quarantine or reject.
• You want to see spoofing attempts against your domain, and whether receivers blocked them.
• You want reports from every receiver in one place instead of a mailbox full of XML attachments.

3. When You Should Not Use It

• You want to know about a failure the moment it happens. Aggregate reports arrive once a day at most, and a day or two behind the mail. For individual failed messages, turn on forensic reports — but most receivers send them rarely and several never do.
• You already run your own DMARC analysis and only want the record published. Untick Use CertaDNS managed reporting and list your own address under Forward a copy to other addresses. Nothing will appear in Reporting.

4. Prerequisites

• A CertaDNS account on any Email Authentication tier.
• The domain added under Email Authentication > Add Domains, or through the Setup Wizard. You do not need Managed DNS for DMARC: your DNS can stay at another provider.
• If your domain's DNS is hosted elsewhere: access to add one CNAME for _dmarc.<your domain>. If the domain is on Managed DNS, CertaDNS publishes the record in your zone and you add nothing.
• For useful results, SPF and DKIM already set up for the services that send your mail. DMARC passes only when one of them passes and aligns with your From: domain.

5. How It Works (Brief)

The record. Your policy, alignment and report addresses are assembled into one _dmarc TXT record. CertaDNS publishes it and republishes it every time you save a change. If your DNS is elsewhere, your _dmarc CNAME points at the published record, so later changes need nothing from you.

The reporting address. With managed reporting on, the record asks receivers to send aggregate reports to an address generated for your domain, of the form dmarc+example-com@reports.certadns.com. Receivers accept it for any domain; you do not need to publish anything to authorise it.

Processing. Reports are read as they arrive, whether sent as XML, gzip or zip. A report a receiver sends twice is counted once. Each sending IP address is matched against known email services; addresses that match none are listed as unidentified senders.

Forensic reports are opt-in, because each one carries a copy of a message someone else received. CertaDNS never stores a message body, and reduces recipient addresses to their domain before anything is saved.

6. How to Use It

Set up DMARC for a new domain

The quickest way is Email Authentication > Setup Wizard:

1. Add a domain — enter it, or choose one already on your account.
2. DMARC configuration — choose a policy (Monitor only is recommended), optionally a subdomain policy, and SPF and DKIM alignment. Under Reporting, aggregate reports come to CertaDNS automatically; add up to four more addresses in Also send a copy to. Tick Receive forensic reports if you want them. Click Save and continue.
3. Publish — create the CNAME shown at your DNS host (Managed DNS domains skip this). Each record shows Live, Propagating or Not found; click Check again after making the change.
4. Alert monitoring — choose how loudly this domain alerts you, then click Done.

Set up or change DMARC from Hosted Services

1. Go to Email Authentication > Hosted Services > Hosted DMARC and choose the domain.
2. If it has no record yet, fill in the form and click Create configuration. If it has one, click Edit configuration, make your changes and click Save changes. Saving republishes the record.

The DNS record to create at your DNS host is listed under Email Authentication > Manage Domains: click the pencil on the domain's row.

Read the reports

Go to Email Authentication > Reporting, pick a view, then pick a domain. DMARC Aggregate covers the last 30 days. Geo Location, SPF Analysis, DKIM Analytics and Mail Volume have a range selector — 7d, 30d, 90d or 1y — limited to what your tier keeps, which is shown beside it. DMARC Forensics shows the last 30 days for one domain or all of them.

Send reports to another tool as well

In the Hosted DMARC form, open Forward a copy to other addresses and enter up to four addresses each for aggregate (rua) and forensic (ruf) reports, one per line or comma-separated. CertaDNS keeps receiving its own copy while Use CertaDNS managed reporting is ticked.

Stop publishing DMARC for a domain

In Email Authentication > Manage Domains, click the bin icon on the domain and confirm Remove from Email Auth. This withdraws the DMARC record and every other email-authentication record for the domain, and deletes its settings and stored reports. It cannot be undone. Parking a domain instead frees a domain slot and keeps DMARC published.

7. Inputs and Settings

To have forensic reports shown under DMARC Forensics, tick Receive forensic reports in CertaDNS in the Hosted DMARC form (or in the Setup Wizard). Unticking it removes only CertaDNS's address; your own forensic recipients stay.

Subdomain policy, percentage, alignment, your own forensic email and fo= are under Advanced options in the Hosted DMARC form. Unticking Use CertaDNS managed reporting removes CertaDNS's aggregate address from the record, and reports stop arriving in the dashboard.

8. Outputs and Results

DMARC Aggregate

• Messages reported and number of reports, with the policy currently published.
• Five outcome tiles: Allowed — Enforced, Allowed — Monitored, Allowed — Override (shown as Allowed — No Action at p=none), Quarantined and Rejected, each with a count and percentage.
• Why receivers delivered failing mail — forwarded, mailing list, local policy and the other reasons receivers give, when any were reported.
• Top Sending Services and Top Sending Domains (the From: domain receivers saw) — the top 10 of each, with message counts and pass rates.
• Unidentified Senders — the top 10 IP addresses not matched to a known service. Click a row for who reported it, when, whether receivers blocked it, why it failed and which network it belongs to. Addresses in known risky networks are marked High Risk.

Other Reporting views

• DMARC Forensics — the report count, most common failure and busiest source, then each failed message: date, domain, source IP, subject, recipient domain and SPF/DKIM result.
• Geo Location — sending countries, split into DMARC compliant, DMARC failed and Threats (failed and from an unrecognised source). Mail with no country in the report is counted and noted below the map.
• SPF Analysis / DKIM Analytics — results by envelope or signing domain, with the share that was aligned.
• Mail Volume — messages per day, split into passed, quarantined and rejected.

Manage Domains

Each domain shows its DMARC policy, how many aggregate (RUA) and forensic (RUF) reports have arrived, a compliance percentage, when the last of each arrived, and how many subdomains receivers have reported mail from.

Alerts

Which alerts a domain sends is set under Email Authentication > Manage Domains, in the domain's Alert monitoring panel (pencil icon). How they reach you is set there (In app, By email) and in Settings > Notifications. The DMARC-related alerts are:

• The DMARC record stopped being served, or the policy being served no longer matches your settings.
• DMARC compliance over the last 7 days fell below your threshold (95% unless you change it; at least 100 messages needed).
• A sender not seen before appeared in your reports.
• A forensic report arrived (Comprehensive preset only).

The recommended Balanced preset covers all of these except forensic reports. Choosing individual alerts is included with Enterprise.

9. How to Interpret Results

Normal

• The first reports arrive 24–48 hours after the record is published.
• Most mail in Allowed — Monitored (at p=none) or Allowed — Enforced, with your known services passing above 95%.
• A small share of failing mail marked as forwarded or from mailing lists. Forwarding breaks SPF legitimately.

Worth investigating

• A service you use in Unidentified Senders or failing. It is missing from your SPF record or not signing with DKIM for your domain.
• High Risk unidentified senders, or failing mail from a From: domain you do not own the sending of. Likely spoofing. If receivers are not blocking it, that is the case for moving to enforcement.
• SPF or DKIM passing but not aligned. The provider is sending or signing with its own domain. It passes its own check and still fails DMARC.
• A sudden drop in pass rate. Usually a legitimate service changed its sending setup or a DNS record was edited.

Common mistakes

• Reading a pass as "authorised". Mail from an unidentified source that passes DMARC may be a service you use that CertaDNS does not recognise. Check before assuming.
• Expecting forensic reports to be complete. They are a sample at best. The aggregate view is the full count.
• Moving to reject after a few days. Some services send weekly or monthly. The DMARC Policy Wizard shows when each stage is safe.

10. Common Issues and Explanations

"… has no DMARC policy yet"

Shown in Reporting for a domain with no DMARC record. Click Set up DMARC for this domain.

"No aggregate reports received yet"

Normal for the first 24–48 hours. After that, check the domain's DNS record under Manage Domains shows Live, and that Use CertaDNS managed reporting is ticked.

"No aggregate reports in this window"

No reports cover the range you picked. Try a longer range, within what your tier keeps.

"No forensic reports"

Forensic reporting is off unless you turned it on, and many receivers never send forensic reports even when asked.

"DMARC configuration already exists for this zone"

The domain already has a record. Choose it in Hosted DMARC and click Edit configuration.

"… isn't a valid email address."

One of the forwarding addresses is malformed. Enter plain addresses such as dmarc@example.net.

Reports forwarded to another address never arrive

An address outside your own domain must authorise receiving reports for it, by publishing <your domain>._report._dmarc.<their domain>. Most DMARC analysis services do this automatically; if not, receivers drop the reports. The form warns you when an address is outside your domain.

Older reports are not shown

Every view is limited to your tier's history: 14 days, 3 months, 1 year or 3 years.

11. Limits and Constraints

12. Related Features

• DMARC Policy Wizard — moving from p=none to p=reject one stage at a time.
• SPF Flattening — fixing senders that fail SPF.
• Hosted DKIM — fixing senders that fail DKIM; uses these reports to show which keys sign your mail.
• MTA-STS and TLS-RPT — reports on encrypted delivery to your domain.
• BIMI — needs DMARC at quarantine or reject.
• Reports (dashboard sidebar) — an email-authentication posture report you can print, or on Plus and above have emailed weekly or monthly.

13. Updates and Behavior Changes

• 30 September 2026. Article rewritten to match the dashboard. Earlier versions described a report list, manual upload, a delete button and a period picker on the DMARC view, none of which are in the dashboard, and a mailbox that was checked on a timer — reports are now processed as they arrive. Removing a domain from Email Authentication withdraws its DMARC record.
• September 2026. Email Authentication moved into its own sections (Setup Wizard, Add Domains, Manage Domains, Hosted Services, Reporting, Domain Health). DMARC reporting is available on every tier; the tier sets how much history you can read. Opt-in forensic reports, extra report recipients and the Geo Location, SPF Analysis, DKIM Analytics and Mail Volume views were added.