Skip to content
Outbox PulseLog in

DMARC aggregate reports

The rua address, inbound mail, and unknown senders.

Each domain gets a rua address like dmarc+token@your-report-domain. Publish it in the DMARC TXT record as rua=mailto:that-address.

Receivers send a gzip or zip XML file. Point Postmark inbound, Amazon SES inbound, or any JSON webhook at /api/inbound/dmarc.

The report page groups messages by source IP. A row is an unknown sender when that IP is not on the domain’s known-sender list. SPF literals found during a check are added automatically, and you can add the rest by hand.

A fail-rate spike alert fires when a report covers at least 10 messages, at least 20% fail SPF or DKIM, and the rate is at least 10 points higher than the previous report.