Monitoring your domain's DMARC reports

Mailbox providers such as Google and Microsoft send a daily DMARC report to every address listed in a domain's rua= tag. The report says which servers sent mail as your domain and whether it passed DKIM and SPF.

Start monitoring. Run a scan of your domain, open the report from the email, and click Show me the records to add. Then click Monitor. Without an account you'll create a free one; with one, the domain is added to it. Free monitors 1 domain, Solo, Starter and Team 2, Business 6.

Prove the domain is yours. On the DMARC monitoring page (it opens after you click Monitor) you'll see your own report address. Add it to the rua= tag of the domain's DMARC record, as a mailto: address, beside any address already there. For example: rua=mailto:you@yourdomain.com,mailto:<your address>. If the record already sends reports to our shared dmarc@ address, you can publish the TXT record shown under the domain instead.

When it starts. We check pending domains daily for their first week, then weekly. Once we find your address or the TXT record, the domain shows as Active and the reports start counting. A subdomain needs its own DMARC record; if it has none, monitor the main domain instead.

The weekly digest. Every Wednesday from 8 AM in your account's time zone, each admin gets one email per active domain about the week before (Monday to Sunday, UTC): what the reports counted, which senders sent as the domain and how often their mail passed, new senders, volume drops, and mail that looks like someone else using the domain, listed by network. Advice to make your policy stricter, or to fix failing senders first, needs at least 100 of your own messages that week. A week with no reports says so. The pause link in the email stops it for that domain; an admin can turn it back on from the DMARC monitoring page.