"Seeing who sends as you"

Big receivers such as Gmail, Microsoft and Yahoo can send a domain's owner a daily summary of the mail they saw from it: which servers sent it, how many messages, and whether each passed SPF, DKIM and DMARC. These summaries are DMARC aggregate reports. Turn them on and we read them for you.

Turning reports on

Open a domain's Settings tab and turn on DMARC reports. An admin can do this. We make a report address just for that domain.

The record to publish

Receivers send reports to the addresses in your DMARC record's rua= tag. We show your record with our address added, so any report tool you already use keeps getting reports too. Copy it and publish it at _dmarc.<your domain> as a TXT record, in place of the current one.

The status under the switch tells you where things stand: whether your record has our address yet, whether you're waiting for the first report (they come about once a day), and when the last one arrived.

If you make a new address, the old one stops working, so publish the record again with the new address.

What the Reports tab shows

The Reports tab covers the last 30 days: how many messages receivers reported, how much passed DMARC, and each sender with bars for passing DMARC, SPF alignment and DKIM alignment.

Senders that need a look come first: ones failing DMARC, and ones we couldn't name. Each sender has its own page with its days, the receivers that reported it and its sending addresses.

The DMARC rollout card uses the same reports. Once at least 100 messages have been reported in 14 days, it shows how much passed and which senders a stricter policy would affect.

Which reports count

Your report address is public, since it's in your DMARC record, and anyone can sign a report as themselves. So the numbers count only reports from major mailbox providers we list, such as Gmail, Microsoft and Yahoo, whose reports are signed with their own keys. That covers the Reports tab, the rollout card and the weekly digest.

Reports from anyone else are kept but not counted. The Reports tab says how many messages they covered, and senders only they reported are folded away under Seen only by other reporters, with no actions. On a sender's page, a receiver we don't count is marked "Not counted".

Acting on a sender you don't know

• It's yours. Choose "This is ours: add it as a flow". We take you to Mail flows with the service filled in where we know it, so its mail can be set up to pass.
• It isn't yours. Choose "Not ours". It moves to its own list. Mail from it may be someone pretending to be you, which a stricter DMARC policy can stop.

Keeping it private

Aggregate reports hold counts and server addresses, never message content. We keep the report files for 30 days and the summaries for 13 months. We don't accept failure reports, which can include messages. We only keep a report signed by the domain it names as its reporter, which stops anyone pretending to be Gmail, and we count only the providers we list.

In healthcheck.email

Open a domain, then Settings, and turn on DMARC reports. Publish the record shown. Reports appear on the domain's Reports tab, in the rollout card and in the weekly digest.