Resources  / DMARC and mail

DMARC forensic reports, with an example

A DMARC forensic report, also called a failure report, describes one message that failed DMARC. An aggregate report says "412 messages from this server failed yesterday". A forensic report says "this message, from this server, with this subject, failed just now", and carries its headers. A domain asks for them with the ruf= tag of its DMARC record.

A forensic report example

Forensic reports use the Abuse Reporting Format (ARF): an email in three parts. A short note for people, a machine-readable part that says what failed, and the headers of the message, sometimes with the body. This is a typical one, about a forged invoice:

From: dmarc-forensic@receiver.example
To: dmarc-failures@example.com
Subject: FW: Your invoice is ready
Content-Type: multipart/report; report-type=feedback-report

--part1
Content-Type: text/plain

This is an authentication failure report for a message
received from IP 203.0.113.77 on Wed, 15 Oct 2026 09:12:44 +0000.

--part2
Content-Type: message/feedback-report

Feedback-Type: auth-failure
User-Agent: ReceiverMTA/2.1
Version: 1
Original-Mail-From: <billing@example.com>
Arrival-Date: Wed, 15 Oct 2026 09:12:44 +0000
Source-IP: 203.0.113.77
Reported-Domain: example.com
Authentication-Results: mx.receiver.example;
  dmarc=fail (p=quarantine) header.from=example.com;
  spf=fail smtp.mailfrom=example.com;
  dkim=none
Delivery-Result: spam

--part3
Content-Type: text/rfc822-headers

From: "Example Billing" <billing@example.com>
To: <[redacted]@receiver.example>
Subject: Your invoice is ready
Date: Wed, 15 Oct 2026 09:12:40 +0000
Message-ID: <8f2c9a@mailer.invalid>

Read the middle part first. Source-IP is the server that sent it. The Authentication-Results line says what failed: here SPF failed because 203.0.113.77 is not in the domain's SPF record, and there was no DKIM signature. The headers below show what the recipient saw. A sender of yours that is set up wrong looks like this too, so check the source address before you call it an attack.

Forensic reporting options

The fo= tag says which failures to report. It has no effect without ruf=.

fo=0

The default. Report when SPF and DKIM both fail to give an aligned pass.

fo=1

Report when either one fails. The most reports, and the most useful while you set up.

fo=d

Report when a DKIM signature fails to verify, aligned or not.

fo=s

Report when SPF fails, aligned or not.

v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com; ruf=mailto:dmarc-failures@example.com; fo=1

Why you may get none

Most large mailbox providers, Google and Microsoft among them, do not send forensic reports. A report holds parts of a message somebody else received, and that is personal data. The receivers that do send them often remove the recipient and the body, as in the example. So a domain with ruf= set gets a handful of reports from smaller providers and security gateways, and none from where most of its mail goes.

The address in ruf= receives that data, so it should be a mailbox that few people read and that your privacy notice covers. An address on another domain needs the same permission record as an aggregate report address.

What they are good for

• Seeing a forgery. The subject line and the From name show what an attacker is sending in your name: fake invoices, password resets, payroll changes.
• Finding a broken sender. A failing message from your own application shows its headers, and the headers show which domain it signed with and which return path it used.
• Timing. They arrive within minutes. Aggregate reports arrive the next day.
• Not counting. They are a sample, from a few receivers. Use the aggregate reports for how much and from where.

Check your DMARC record to see whether it asks for failure reports, and where they go.