[{"data":1,"prerenderedAt":179},["ShallowReactive",2],{"publication:en:P181":3},{"meta":4,"copy":17,"relatedArticles":139,"terms":171,"term":172,"resourceParent":173,"glossaryParent":176},{"id":5,"path":6,"kind":7,"keyword":8,"title":9,"seoTitle":10,"description":11,"incoming":12,"updated":15,"preparedOn":16},"P181","\u002Fblog\u002Fdmarc-report-reading","article","how to read DMARC reports","How to read DMARC reports and choose the next sender check","How to read DMARC reports: fields and decisions","Read DMARC report windows, source counts, identities and alignment. Use a triage worksheet while keeping reported handling separate from inbox placement.",[13,14],"\u002Fservices\u002Femail-domains","\u002Fservices\u002Fcorporate-email","2026-07-20","2026-10-30",{"intro":18,"sections":19,"checklistTitle":93,"checklist":94,"faq":102,"sources":112,"links":115,"cta":134},"To read DMARC reports, first identify the reporter and time window, then connect each source group to its authenticated identities, alignment and reported handling. Map the source to a business owner before choosing a change. Aggregate reports describe observed authentication activity; they are not a complete mail inventory, proof of inbox placement or an automatic list of servers to authorize.",[20,29,65,70,80,88],{"title":21,"paragraphs":22,"sources":25},"Establish which report and observation window you are reading",[23,24],"Record the reporting organization, report identifier, covered domain and beginning\u002Fend of the reporting period. Normalize timezones before comparing with business activity. Reports can arrive later than the observation window and can overlap with other exports. Distinguish a new reporting interval from another copy of the same report.","Use an appropriate reporting tool or authorized parser, preserving the original record when needed. Confirm the supported report version instead of assuming every XML export or dashboard label is identical. Avoid uploading business reporting data to an unfamiliar public service; source addresses and domain relationships can reveal operational information.",[26],{"label":27,"url":28},"RFC 9990: DMARC aggregate reporting","https:\u002F\u002Fwww.rfc-editor.org\u002Frfc\u002Frfc9990.html",{"title":30,"paragraphs":31,"table":34},"Read fields as separate observations",[32,33],"The connecting source, grouped message count, visible From identity, raw authentication results and DMARC evaluation play different roles. A passing raw DKIM result for a provider domain is not necessarily a passing aligned business-domain result. Read the identities alongside the labels rather than concluding that any occurrence of pass means the intended configuration is complete.","The count belongs to the grouped observation in the report. It is not a count of unique people, compromised accounts or all messages the business sent. Keep the reporting organization and window attached when comparing counts, and do not sum duplicate exports as independent activity.",{"caption":35,"headers":36,"rows":40},"A practical DMARC report-reading worksheet",[37,38,39],"Field or group","Question it helps answer","Limit to retain",[41,45,49,53,57,61],[42,43,44],"Reporter, report ID and date_range","Which observation and time window is this?","Arrival time and observation time can differ.",[46,47,48],"source_ip and count","Which connecting source and message group were observed?","An IP is not automatically a named business sender or attacker.",[50,51,52],"header_from and envelope\u002Fsigning identities","Which domains were involved?","Visible and authenticated identities may differ.",[54,55,56],"auth_results","What SPF\u002FDKIM results were recorded for which identities?","A raw pass is different from alignment.",[58,59,60],"policy_evaluated and reasons","What DMARC evaluation and handling context was reported?","Reported disposition is not inbox placement.",[62,63,64],"Published policy context","Which policy was observed for the evaluation?","A policy may change during or around a reporting period.",{"title":66,"paragraphs":67},"Map the source to a business system before changing policy",[68,69],"Group observations by the likely sending platform and confirm ownership with the business or provider. Include website forms, invoice services and other third parties. Infrastructure names and IP ownership can support a hypothesis but do not establish that the business authorized a particular message route. Keep known, unknown and under-investigation groups distinct.","For a legitimate source that fails alignment, request a controlled received-message example and compare the provider's supported configuration. For an unknown source, investigate context before authorizing or labeling it. Do not expand SPF solely to remove a red row in a dashboard; an improved-looking chart is not a justified trust decision.",{"title":71,"paragraphs":72,"sources":75},"Choose the next check from the result and its limits",[73,74],"If an aligned DKIM signature passes while SPF does not supply alignment, DMARC may still pass. If raw authentication passes but neither identity aligns, investigate the intended domain configuration. If the source is a forwarding or intermediary path, compare its actual message behavior rather than treating it as a new direct sender.","A receiver may report handling influenced by local policy or other context. Read relevant reasons and report-version semantics. A reported reject or quarantine observation should not be restated as a complete delivery history, and a pass does not prove that an authorized account or business request was legitimate.",[76,79],{"label":77,"url":78},"RFC 9989: DMARC, May 2026","https:\u002F\u002Fwww.rfc-editor.org\u002Frfc\u002Frfc9989.html",{"label":27,"url":28},{"title":81,"paragraphs":82,"example":85},"Build a triage register instead of an automatic enforcement rule",[83,84],"For each material group, record the business owner, evidence window, identities, alignment result, uncertainty and next action. Assign an owner to obtain a sample, correct configuration, confirm a retired source or investigate suspicious use. A useful register separates a confirmed correction from a proposal that has not been tested.","Before using the reports to support stronger policy, review which senders or receivers may be absent and whether periodic systems have been checked another way. The none-to-reject guide turns that evidence into readiness and hold criteria. Report reading alone is not authorization to change the domain's enforcement.",{"title":86,"text":87},"Illustrative count and coverage limit","A hypothetical row contains 40 messages from one source during one receiver's window. That is not evidence of 40 victims or 40 inbox deliveries, and it does not describe a monthly invoice platform that did not send during the observed period.",{"title":89,"paragraphs":90},"Verify corrections and maintain the reporting boundary",[91,92],"After a supported configuration change, verify fresh controlled messages from the affected source and review later reports for comparable periods. Preserve the original issue and new result so a later owner can understand what changed. Reporting delay and coverage mean an immediate empty dashboard is not proof that the correction resolved every route.","CyberFixCrew is an Israeli cybersecurity company serving businesses worldwide with business-email and digital-infrastructure services. Our Israeli technical knowledge connects report fields to a sender inventory, appropriate technical checks and an accountable next step. Share the domain and reporting question first; private reports and message evidence need an agreed handling scope.","DMARC report triage checklist",[95,96,97,98,99,100,101],"Reporter, ID, domain and observation window retained","Duplicates and overlapping exports considered","Raw authentication, alignment and disposition separated","Material source groups mapped to business ownership","Unknowns remain explicit rather than automatically authorized","Next action and owner assigned per material group","Corrections verified with messages and later comparable reports",[103,106,109],{"question":104,"answer":105},"Does a high count of failures mean that many customers were attacked?","No, a report groups message observations for a receiver and time window. The count does not establish unique people, successful fraud, account compromise or final delivery. Interpret it with the source, identities, policy and business context before deciding what it means.",{"question":107,"answer":108},"Should I add every reported source to SPF?","No: confirm that the business authorizes the source and determine which identity and mechanism it actually uses. Some observations involve forwarding or unauthorized use. DNS authorization should follow a supported business decision, not an attempt to turn every dashboard row green.",{"question":110,"answer":111},"Can reports prove that my legitimate mail reaches the inbox?","No, they provide authentication and handling observations within their reporting scope. Inbox placement and actual receipt require evidence from the relevant receiving environment. Use controlled messages and the delivery-diagnosis workflow when that is the business question.",[113,114],{"label":27,"url":28},{"label":77,"url":78},[116,119,122,125,128,131],{"path":117,"label":118},"\u002Fservices\u002Fdmarc-spf-dkim","Scope sender mapping and domain authentication",{"path":120,"label":121},"\u002Fblog\u002Fdmarc-none-to-reject","Assess readiness for enforcement",{"path":123,"label":124},"\u002Fblog\u002Fdkim-selector-check","Check a specific DKIM signature",{"path":126,"label":127},"\u002Fglossary\u002Fspf","Understand the SPF identity and result",{"path":129,"label":130},"\u002Fblog\u002Femail-spam-diagnosis","Diagnose delivery and spam placement",{"path":132,"label":133},"\u002Fresearch\u002Fmethodology","Understand how evidence and examples are labeled",{"title":135,"description":136,"button":137,"type":138},"Turn the report into an accountable next step","Describe the domain, reporting period and question. We can clarify what the observations support and which source needs verification.","Discuss DMARC report interpretation","check",[140,148,156,164],{"id":141,"path":120,"title":142,"description":143,"category":144,"artwork":145,"order":146,"publishedOn":147},"P050","DMARC none to reject: readiness checks before enforcement","Map legitimate senders and verify alignment before DMARC enforcement. Define report coverage, hold points, provider support and rollback without legacy pct.","email","security",57,"2026-08-05",{"id":149,"path":150,"title":151,"description":152,"category":144,"artwork":153,"order":154,"publishedOn":155},"P182","\u002Fblog\u002Fmicrosoft-365-security-checklist","Microsoft 365 security checklist for small businesses","Review tenant ownership, admin recovery, authentication, mail, sharing and apps. Match checks to licenses and record evidence before changing business access.","plan-business",44,"2026-07-04",{"id":157,"path":158,"title":159,"description":160,"category":144,"artwork":161,"order":162,"publishedOn":163},"P183","\u002Fblog\u002Fgoogle-workspace-security-checklist","Google Workspace security checklist: accounts, mail and sharing","Review administrators, recovery, 2-Step Verification, Gmail, Drive and app access. Build an action register around the actual Workspace edition and evidence.","integrations",38,"2026-06-18",{"id":165,"path":123,"title":166,"description":167,"category":144,"artwork":168,"order":169,"publishedOn":170},"P061","How to check a DKIM selector and verify an actual message","Find the DKIM selector and signing domain in a real message. Inspect the DNS key and trusted receiver result, separating key presence from active signing.","access",65,"2026-08-19",[],null,{"path":174,"label":175},"\u002Fresources","Website security resources and templates",{"path":177,"label":178},"\u002Fglossary","Cybersecurity glossary for small businesses",1794134058859]