DMARC aggregate report (RUA)
A DMARC aggregate report (RUA) is the periodic XML summary mail receivers send to the address a domain's DMARC record names in its rua tag, listing SPF and DKIM results for mail claiming that domain, broken down by sending source. AdminKit's guide to reading these reports covers the staged rollout decisions they're meant to inform.
By AdminKit team, Netbase JSC · Updated
A DMARC aggregate report (RUA) is the machine-readable report a receiving mail server generates about the mail it saw claiming to come from a domain — volume, source IPs, and whether each message passed SPF and DKIM — and sends to the address the domain names in DMARC’s rua tag. Its XML schema is defined in RFC 9990, delivered as a gzip-compressed attachment; RFC 9989, the current core DMARC specification, recommends receivers send one at least every 24 hours. Unlike the raw DMARC policy record, which only sets what happens to failing mail, an aggregate report shows a domain owner which legitimate sending sources would actually fail before they move to enforcement. A separate, optional forensic report (RUF) covers individual failing messages but has far thinner receiver support. Raw RUA XML is rarely read by hand; most domains feed it into a parsing dashboard instead.