What DMARC Reports Tell You (and How to Move from p=none to p=reject)
A DMARC record set to p=none only watches. It does not stop anyone sending fake emails from your domain. The reports it produces show every service that sends email as you, which is what you need to know before you move to p=quarantine and then p=reject.
What a DMARC report is
Once your DMARC record includes a rua= address, the big email providers send that address a report, usually once a day. Google, Microsoft and Yahoo all do this.
Each report is a small zipped file in a format called XML. It lists every server that sent email claiming to be from your domain, how many emails it sent, and whether they passed SPF and DKIM.
The reports contain no message content, no subject lines and no recipient addresses. They are counts and results only.
You may also see ruf= mentioned. That asks for a separate report on each failed email. Most large providers don’t send these, so you can leave it out.
What is inside a report
| Part of the report | What it means |
|---|---|
| Reporting organisation and dates | Who sent the report (for example google.com) and the 24 hours it covers. |
| Policy published | The DMARC record the provider saw on your domain. |
| Source IP | The server that sent the email. |
| Count | How many emails that server sent in the period. |
| Disposition | What the provider did: none (delivered as normal), quarantine (spam folder) or reject. |
| DKIM and SPF result | Pass or fail for each, after checking the domain matches your From address. |
| Auth results | The domains that actually signed the email and passed SPF. This shows which service sent it. |
How to read reports without reading XML
You can open the files in a text editor, but nobody enjoys it. A report service turns them into a simple table of senders.
At the time of writing, free options include Postmark’s weekly DMARC digest, Valimail Monitor, and Cloudflare DMARC Management if your DNS is with Cloudflare. Paid services such as dmarcian and EasyDMARC also have small free plans.
To use one, you change the rua= address in your DMARC record to the address the service gives you. You can list two addresses, separated by a comma, if you want to keep your own copy.
Sort every sender into one of three groups
This is the real work. Go through the list of sources and decide which group each belongs to.
- Yours, and passing. Your main email provider (Google Workspace or Microsoft 365) should be here. Nothing to do.
- Yours, but failing. These are services you use that send as your domain without being set up properly. Typical examples are a website contact form, a newsletter tool, an accounts package sending invoices, a booking system or a CRM.
- Not yours. Servers you don’t recognise, often abroad, sending small numbers of emails that fail both checks. These are people faking your address, and they are what
p=rejectwill stop.
Group 2 is the one to fix. For each service, turn on its ‘custom domain’ or ‘domain authentication’ option, which adds a DKIM record for your domain. Add it to your SPF record as well if the service asks for that.
You will also see a few failures from Google, Microsoft or university servers where DKIM passes but SPF fails. That is normally forwarding: someone receives your email and forwards it on automatically. It is harmless, and it is why DKIM matters more than SPF here.
What 'pass' actually means
DMARC passes when either SPF or DKIM passes and the domain it passed for matches the domain in your From address. This matching is called alignment.
An email can pass SPF for the newsletter company’s domain and still fail DMARC, because that is not your domain. Aim for an aligned DKIM pass on every genuine sender. DKIM survives forwarding. SPF does not.
Moving up in three stages
Swipe sideways to see the whole table.
| Stage | Record | What happens to failing email |
|---|---|---|
| 1. Monitor | v=DMARC1; p=none; rua=mailto:dmarc@yourcompany.co.uk |
Nothing. It is delivered as normal and reported. |
| 2. Quarantine | v=DMARC1; p=quarantine; rua=mailto:dmarc@yourcompany.co.uk |
It goes to the spam folder. |
| 3. Reject | v=DMARC1; p=reject; rua=mailto:dmarc@yourcompany.co.uk |
It is refused and never arrives. |
Stay at each stage for at least two weeks, and longer if you send monthly invoices or newsletters. You want the reports to cover everything your business sends.
Before each step up, check three things:
- Every genuine sender shows an aligned DKIM pass.
- You can explain every source that is still failing.
- No new senders have appeared in the last two weeks.
Older guides suggest easing in with a pct= tag, such as pct=25. That tag was removed from the DMARC standard in May 2026 because providers applied it inconsistently. Move a whole stage at a time instead.
If something breaks after you tighten the policy
The usual sign is a genuine email bouncing with a message such as 550 5.7.26 from Gmail or 550 5.7.509 from Microsoft, both mentioning your DMARC policy.
Change the record back to the previous stage. It is one DNS edit and normally takes effect within an hour. Then find the sender in your reports, fix its DKIM set-up and try again.
Domains that never send email
If you own extra domains that are only used for a website, or not used at all, lock them straight away. Give each one a DMARC record of v=DMARC1; p=reject and an SPF record of v=spf1 -all. Scammers like unused domains because nobody is watching them.
Keep the reports coming
Leave the rua= address in place once you reach p=reject. A new tool added next year will show up in the reports as failing, and you will see it before your customers do.
Not sure whether your record is set up correctly in the first place? Start with Check your email is set up correctly and What is SPF, DKIM and DMARC?.
Need help fixing this?
We provide:
- Free initial assessment
- Clear explanation of the issue
- Fixed-price solutions
- UK-based support
Send us a few of your DMARC reports and we’ll tell you which senders need fixing before you tighten your policy.