SentraDMARC

Understanding DMARC reports

DMARC aggregate reports are how you find out who sends mail as your domain. Each receiver that honours DMARC (Google, Microsoft, Yahoo and many others) sends a summary of the mail it saw claiming to come from you, usually once a day. With your _dmarc record pointing at us, those reports come to SentraDMARC.

A first week of reports routinely turns up senders nobody remembers setting up (a payroll system, a website form, a contractor's CRM) alongside anything spoofing you. Until the reports arrive, none of it is visible.

What a report contains

  • Source address: the IP that sent the mail.
  • Volume: how many messages.
  • SPF and DKIM results, and the domains they were checked on.
  • The DMARC result: whether SPF or DKIM passed and aligned with your From domain.
  • What the receiver did with the mail, and sometimes why (for example, that it was forwarded).

Reports are about volumes and results. They contain no message content and no recipients.

What the DMARC page shows

  • The score and checklist: your policy, how much of your senders' mail passes, and what is left to fix.
  • The enforcement rail: where your policy is on the ladder and the one recommended next step. See The enforcement ladder.
  • Sender cards: report sources grouped into named senders, by provider or by the network that owns the address. See Reading your senders.
  • Pass and fail volume over time, one bar per day.
  • Every report received, each downloadable as its original XML.

We do not run a threat-intelligence feed, and we do not geolocate senders.

When reports arrive

Receivers send reports for the previous day, once they have seen mail from your domain. A new domain usually has its first reports within a day of sending mail. If DMARC reporting is on and no report has arrived for seven days, you get an alert ("DMARC reports stopped arriving"), because silence is more often a broken record than a quiet week.

Exporting

The Export Audit button on the dashboard downloads your DMARC report rows as CSV, for a date range within your plan's retention. See Plans, usage and leaving.