Monitoring your domain's DMARC reports

Mailbox providers such as Google and Microsoft send a daily DMARC report to every address listed in a domain's rua= tag. The report says which servers sent mail as your domain and whether it passed DKIM and SPF.

Start monitoring. There are three ways in. On Settings > DMARC monitoring, click Monitor beside one of your verified sending domains, or type any other domain or subdomain under Add a domain. Or run a scan of your domain, open the report from the email, and click Monitor there; without an account you'll create a free one. Only admins can add domains. Free monitors 1 domain, Solo, Starter and Team 2, Business 6.

Prove the domain is yours. Every domain starts as Waiting for setup. Settings > DMARC monitoring shows the domain's DMARC record as it is now, and under it the exact line to publish in its place: the same record with your own report address added to its rua= tag as a mailto: address. It keeps the record's policy and its mailto: report addresses; a report address that isn't mailto: is left out, since providers send these reports by email. Paste it as one TXT value at the host shown, which is _dmarc. followed by the domain. If the domain has no DMARC record yet, you get a full record to add. It starts at p=none, unless the domain is a subdomain under a main domain that has a DMARC record: then it keeps the main domain's policy, its alignment and pct= settings and its report addresses, so adding it never weakens the subdomain's protection. If one of those addresses belongs to a DMARC service at another company, check with them first: some only accept reports for the domains you've set up with them. Sometimes we offer no line at all: when the record has no valid p=, an sp= that isn't valid, or more than one p= or sp=, or when a subdomain has no record and its main domain's record isn't being applied (it has more than one, or one of those faults). Providers don't apply that record as written, so we can't tell which policy you meant. The page says what's wrong; fix that record, then come back for the line. If the record already sends reports to our shared dmarc@ address, you can publish the TXT record shown under the domain instead.

When it starts. Once the record is published, click Check now and we check that domain straight away. You can check each domain once a minute. We also check on our own every day at 05:30 UTC: every day for a new domain's first week, then once a week. When we find your address or the TXT record, the domain shows as Active and its reports start counting.

Subdomains. A subdomain with no DMARC record of its own uses its main domain's record, and mailbox providers send its reports with the main domain's. So monitor the main domain (acme.com, not mail.acme.com), and once it's Active those reports show under it. A subdomain with its own DMARC record sends its reports wherever that record says, so add your report address to that record too. To monitor a subdomain by itself, give it its own DMARC record that names your address.

Sending domains. When you add a sending domain in Settings > Sending, the DMARC record we suggest already names your report address. It's built from the domain's current DMARC record, or from its main domain's policy, so it keeps the policy the domain has now. If that record, or the main domain's, isn't being applied as written, we don't suggest one, and the setup says what to fix first. Publish it and click Monitor beside the domain once it's verified.

The weekly digest. Every Wednesday from 8 AM in your account's time zone, each admin gets one email per active domain about the week before (Monday to Sunday, UTC): what the reports counted, which senders sent as the domain and how often their mail passed, new senders, volume drops, and mail that looks like someone else using the domain, listed by network. Advice to make your policy stricter, or to fix failing senders first, needs at least 100 of your own messages that week. A week with no reports says so. The pause link in the email stops it for that domain; an admin can turn it back on from Settings > DMARC monitoring.

How long reports are kept. Free keeps 90 days of reports and paid plans keep 13 months. Each night we delete anything older. Reports older than 90 days are deleted the night after you move to Free. The DMARC page shows every week your plan still holds.

DMARC alerts. Paid plans and the trial also get alerts; Free doesn't. Every day at 16:00 UTC we check the reports for the UTC day two days earlier, and three days earlier for drops in mail, because providers send them one to three days late. There are three alerts. A server we can't identify sent at least 20 messages that failed DMARC, and it hadn't sent mail as the domain in the 28 days before. A known sender, such as Google Workspace, sent at least 50 messages and under 90% passed, after at least 95% passed over the 7 days before. Or the day's reported mail fell under half its daily average for the 7 days before, when that average is at least 100 messages. New-server alerts start once a domain has been active for 28 days.

Who gets alerts. Each admin gets one email per domain with that day's sender alerts, and a separate email a day later if that day's mail dropped. The domain's DMARC page lists the alerts from the last 30 days. The link in the email turns alert emails off for that domain; an admin can turn them back on from Settings > DMARC monitoring. While emails are off, the alerts still show on the DMARC page.