What is DMARC monitoring?
DMARC monitoring reads the daily reports receivers send about your domain and checks your DNS records. What it collects, what to watch for, and when to enforce.
What is DMARC monitoring?
DMARC monitoring is the ongoing collection and review of the reports that mail providers send about your domain, plus regular checks of your SPF, DKIM and DMARC records in DNS. It shows every server sending mail as your domain, whether that mail passes authentication, and what receivers did with the mail that failed. It is how you move a domain from p=none to p=reject without blocking your own mail.
Publishing a DMARC record is a single DNS change. Monitoring is what comes after it, for as long as the domain sends mail: senders change, vendors rotate keys, and someone in marketing signs up for a new email tool without telling IT.
What does DMARC monitoring collect?
Two kinds of data, from two directions:
- Aggregate reports from receivers. When your DMARC record carries an
rua=tag, Gmail, Microsoft, Yahoo and most other providers send a daily XML summary of the mail they received from your domain: source IP, message count, SPF and DKIM results, alignment, and the disposition they applied. How to read an aggregate report walks through the format field by field. - Your own DNS records. The DMARC, SPF and DKIM records that receivers evaluate against. A record that changes, disappears or exceeds the SPF 10-lookup limit changes the result for every message, so it is checked on a schedule rather than once.
Some receivers also send per-message failure reports, but Gmail and Microsoft send none, so aggregate reports carry almost all of the evidence.
What should you watch for in DMARC reports?
- New senders. An IP range or service that was not in last week’s reports. It is either a tool someone added, which needs SPF and DKIM set up, or someone sending as you without permission.
- Alignment failures from known senders. A service passes SPF or DKIM for its own domain but not yours. The mail authenticates and still fails DMARC. DMARC alignment explains why.
- Forwarding. Mailing lists and forwarders break SPF and sometimes DKIM. These failures look alarming in raw XML but are expected, and ARC is how receivers recover the original result.
- Record drift. A DNS change that removed the
rua=tag, pushed SPF past 10 lookups, or published a DKIM key with a typo. - Volume changes. A sudden drop in reported volume often means reports stopped arriving, not that mail stopped. A sudden rise from unknown sources is worth a look the same day.
Can you monitor DMARC without a tool?
Yes, for a small domain. Point rua= at a mailbox you control, unzip the attachments and read the XML. The cost is time: a domain with a few senders receives reports from dozens of providers each day, each listing every source IP separately.
| Task | By hand | With a monitoring tool |
|---|---|---|
| Collect reports | A mailbox you empty and unzip | A reporting address the tool parses on arrival |
| Identify senders | Look up each IP and its owner | IPs grouped by provider, with known services named |
| Spot changes | Compare this week’s XML with last week’s | An alert when a new sender or a failure spike appears |
| Check DNS | Run lookups when you remember to | Scheduled checks of DMARC, SPF and DKIM records |
| Track progress to p=reject | A spreadsheet | Pass rates per sender over time |
To try it on one report first, paste the XML into the free DMARC report analyzer.
How long should you monitor before enforcing DMARC?
Plan on four to eight weeks at p=none for most domains. That is long enough for monthly senders, such as billing runs and newsletters, to appear in the reports at least once. Move to p=quarantine when every legitimate sender passes with alignment, then to p=reject. DMARC p=none vs p=reject covers each step.
Monitoring does not end at p=reject. At enforcement, a misconfigured new sender is rejected rather than reported, so the reports are how you find out before your customers do.
DMARC monitoring with DDMARC
DDMARC collects and parses your aggregate reports, names the services behind each source IP and alerts you when a new sender appears. Paid plans also check your DNS records on a schedule, daily or more often. Prices are per domain, never per email:
- Monitor is free for 2 domains, with 30 days of report history and no card.
- Protect is $29/mo for 5 domains, with 1 year of history, forensic reports, the API and Slack alerts.
Every plan is on the pricing page. To see where a domain stands today, check it without an account.
Frequently asked questions
Is DMARC monitoring the same as p=none?
No. p=none is a policy that tells receivers to deliver failing mail normally. Monitoring is reading the reports that policy produces. A domain at p=none with no rua= tag is not monitored at all, and a domain at p=reject still needs monitoring.
How soon do DMARC reports arrive?
Most providers send aggregate reports once a day, so the first ones arrive within 24 to 48 hours of publishing a record with an rua= tag.
Do I need DMARC monitoring if I only have one domain?
Yes, if that domain sends mail. Google, Yahoo and Microsoft require DMARC from bulk senders, and the reports are the only record of who else is sending as you. A free plan or the manual approach above is enough for a single domain with a few senders.
Sources
- RFC 9989: Domain-based Message Authentication, Reporting, and Conformance (DMARC)
- RFC 9990: DMARC Aggregate Reporting
See what your own domain is publishing.
Everything in this article is externally observable. The free checker reads your records and tells you which of them are missing, weak, or already doing their job.