DMARC forensic reports
See the phishing sent as your domain: who sent it, from which IP address, with which subject. Upload failure reports (.eml, .zip).
See a sample Have aggregate reports (.xml)? Use the DMARC report analyzer.
Reports are kept until you delete them. Only you can see them unless you create a share link. Links inside the messages are shown made safe and are never clickable.
What DMARC failure reports are
A DMARC failure report, also called a forensic report, is a copy of a single message that failed DMARC. It is an email with an attached message in the ARF format: the headers of the failed message, often its subject and sender, and the IP address it came from. When someone sends phishing as your domain and a receiving server supports these reports, you get to see the actual message.
How they differ from aggregate reports
- Aggregate reports (the
ruaaddress) are daily XML summaries with counts per sending source. Nearly every large provider sends them. Use the report analyzer for those. - Failure reports (the
rufaddress) describe one message each, as it happens, and can contain private details of the message.
Why few providers send them
Because a failure report can expose the content and addresses of real mail, most large mailbox providers do not send them at all: Google, Microsoft and Yahoo send aggregate reports only. Some smaller providers and security-minded receivers do, so expect a trickle, not a flood. Even a few are useful: they show you the real subjects and sending servers of phishing aimed at your customers.
How to ask for them
Add a ruf address and the fo option to your DMARC record. With fo=1 receivers report when any check fails, not only when both do:
_dmarc.example.com. TXT "v=DMARC1; p=none; rua=mailto:[email protected]; ruf=mailto:[email protected]; fo=1"
Save the reports you receive as .eml files (or zip them) and upload them above. You can generate a DMARC record with these options if you do not have one yet.