Forensic Reports
Forensic reports (RUF - Report URI Forensic) provide detailed information about individual emails that fail DMARC authentication. Use them to investigate spoofing attempts and diagnose configuration issues.
Available from Protect ($29/mo) upward
Forensic reports are included on Protect, Growth, Professional, Enterprise, and both Partner plans. The free Monitor tier does not include them.Compare plans.
What Are Forensic Reports?
Unlike aggregate reports (RUA) that summarize authentication results, forensic reports provide details about individual failed messages. They include:
Sampled Headers
A redacted sample of the original message headers — From, To, Subject, and routing, minus tracking headers
Source Information
IP address, country, and ASN of the sending server
Authentication Results
The Authentication-Results header, with SPF, DKIM, DMARC, and ARC parsed out
Failure Reason
Specific reason why authentication failed (alignment, signature, etc.)
Aggregate vs Forensic Reports
| Aspect | Aggregate (RUA) | Forensic (RUF) |
|---|---|---|
| Frequency | Daily summary | Per-message (real-time) |
| Content | Statistics and counts | Individual message details |
| Use Case | Trend analysis, monitoring | Incident investigation |
| Privacy | Anonymized data | Contains PII (headers) |
| Provider Support | Universal | Limited (Gmail, Yahoo, etc.) |
Using Forensic Reports
Opening the page
Forensic Reports is not in the sidebar. Reach it from the Forensic Reports (RUF) card on the Failures page, or press Cmd +K and search for “Forensic”. Reports are listed newest first.
Filter the list
Two filters are available on the list: domain and failure type (SPF, DKIM, or DMARC). Results are paginated 20 at a time.
View Details
Click on any report to see full details including message headers, authentication results, and geographic information about the sender.
Report Details
Each forensic report contains the following information:
Message Information
- • Arrival date and time
- • Original mail-from and rcpt-to addresses
- • Message-ID of the report
- • Subject line, when the receiver included it in the sampled headers
Source Information
- • Source IP address
- • Country (two-letter code)
- • ASN and ASN organization
- • Reporting MTA (user agent)
Authentication Results
- • The full Authentication-Results header as received
- • Parsed SPF, DKIM, DMARC, and ARC method results
- • Reported domain
- • Delivery result applied by the receiver
Failure Details
- • Failure type (SPF/DKIM/DMARC)
- • Specific failure reason
- • Reported domain
- • Delivery result
Common Use Cases
Investigating Spoofing Attempts
When you see failures from unknown IPs, forensic reports help identify if someone is attempting to spoof your domain. Check the source IP, location, and headers.
Debugging Legitimate Failures
If legitimate email services are failing authentication, forensic reports show exactly what went wrong—missing SPF entries, DKIM signature issues, or alignment problems.
Monitoring New Senders
Before adding a new service to your SPF record, let it send some test emails. Forensic reports will show the exact IP addresses that need to be authorized.
Enabling Forensic Reports
To receive forensic reports, add the ruf tag to your DMARC record:
v=DMARC1; p=quarantine; ruf=mailto:your-ruf-token@ruf.ddmarc.com; fo=1Use your own address, not the one above. your-ruf-token is a placeholder. Every domain gets its own RUA and RUF addresses so reports can be routed to the right account. Copy the exact values from Domains → your domain → DNS & Setup. A record that points at a token you did not generate will never deliver anything to you.
ruf=specifies where to send forensic reportsfo=1generates reports on any failure (recommended)
Privacy Considerations
Forensic reports can contain personally identifiable information from email headers. That is exactly why provider support is thin: some receivers send RUF, while Microsoft does not send it at all. Expect partial coverage.
What DDMARC does with the samples it receives:
- • Tracking-oriented headers are dropped on ingest (X-Originating-IP, X-Mailer, X-MimeOLE, X-Priority, and similar)
- • At most 100 headers are stored per sample, each truncated to 1,000 characters
- • Report files above 5 MB are rejected
- • Access is restricted by role within your organization
Email addresses in the sample are kept intact so you can match a failure to a sender — treat forensic data as sensitive and share it accordingly.