A DMARC aggregate (RUA) report is an XML file each receiver sends daily, summarizing mail claiming to be from your domain. The key fields are the source IP, the count, and the SPF/DKIM pass + alignment results. You use it to find every sender and confirm the legitimate ones pass before enforcing.
Each <record> has a source IP, a message count, the DMARC disposition (none/quarantine/reject applied), and <policy_evaluated> plus <auth_results> showing whether SPF and DKIM passed and aligned. Aligned + pass = good; pass-but-not-aligned = a DMARC failure to fix.
Group by source IP to identify each service. For legitimate ones that fail alignment, enable domain-aligned DKIM or fix SPF. For unknown sources sending real volume, investigate — they may be spoofing. Raw XML is hard to read at scale, so a reporting tool (or Skysnag) parses it for you.
Check your DMARC record now
Open the free DMARC checker →Some are forwarders or legitimate services you forgot; others can be spoofers. The report is exactly how you discover them before moving to enforcement.
