Analysing DMARC aggregate reports properly

Analyse aggregate reports in the Conbool dashboard: identify sending sources, check SPF and DKIM alignment and separate legitimate from suspicious senders.

Aggregate reports are machine-readable XML files that can hardly be analysed in a mailbox. DMARC Reports condenses them into charts, lists of sending sources and concrete recommendations.

What an aggregate report contains

Mail providers send one summary report per day to the rua address. It counts per sending source how many messages passed DMARC and how many failed. Conbool combines these values into the pass rate and shows the history, a geographic distribution and the separation into inbound and outbound.

Identifying sending sources

Every sending server IP is classified by volume, country and type. The classification distinguishes, among others, app and newsletter services, email providers, forwarders and gateways from unknown sources. It can thus be clarified quickly whether a new IP is a legitimate service or a spoofing attempt.

Sending sources in the DMARC report with authentication status

Sending sources with SPF and DKIM status.

Checking SPF and DKIM alignment

The authentication overview breaks the messages down by SPF and DKIM:

Both passed: SPF and DKIM are aligned to the sender domain. Your own, legitimate mail streams.
SPF only: often a DKIM selector is missing in DNS or a forwarder has changed the message.
DKIM only: the sending server is often missing from the SPF record or the envelope address deviates.
Both failed: typical suspicion of spoofing, which a policy from p=quarantine catches.

The basics are explained in SPF and DKIM as the foundation of DMARC.

Recommendations and alerts

With a pass rate stable for more than 14 days, Conbool suggests raising the policy to p=quarantine or p=reject. Further recommendations report a drop in the pass rate, unknown sending sources, unsigned mail of your own or repeated spoofing attempts. Critical events go out immediately as an email to the configured recipients, a summary daily, weekly or monthly as chosen.

The notification frequency can additionally be scheduled under settings in the DMARC Reports area, custom by weekday and time, with selectable weekdays and up to four times per day. The MailGuard quarantine uses the same schedule.

Once the reports are clean, the staged policy migration follows. Creating the matching DMARC record is the precondition. Inbound protection against spoofing is handled by MailGuard.