DMARC Failure Report (RUF)

A DMARC failure report, often called a RUF or forensic report, is a message a receiving mail server may send when a single email claiming a domain fails DMARC, addressed to the URIs that domain lists in its DMARC record’s ruf tag. IANA’s DMARC Tag Registry lists ruf as the tag for reporting URIs for message-specific DMARC failure reports. RFC 9991, a Proposed Standard published in May 2026 per its IETF Datatracker entry, now defines these reports and obsoletes the earlier text in RFC 7489 section 7.3. Each report covers one failing message or a group of similar messages failing for the same reason, and is built on the Abuse Reporting Format with the authentication-failure fields from RFC 6591, so it can say which of SPF or DKIM failed and include the message’s headers. When several ruf URIs are given, RFC 9991 says the report generator must try to deliver to each of them.

When is a RUF report worth asking for?

Failure reports help a domain owner investigate a specific failing source that an aggregate report has revealed, or spot spoofed mail using the domain quickly. The cost is privacy: RFC 9991 warns that they may include personal and non-public information, recommends limiting their scope and duration to targeted diagnostics, and suggests redacting message bodies and header fields. It also notes that many large providers limit or turn off failure reports entirely, so most domains get far fewer RUF reports than rua reports, and should plan their monitoring around the aggregate data.

AdminKit’s DMARC check shows whether a domain’s record sets a ruf address, and the DMARC report analyzer reads the aggregate XML that remains the main data source. DMARC failure reports are part of AdminKit’s email authentication cluster; the full AdminKit glossary lists other related terms.