DMARC Failure Reports vs Aggregate Reports: RUF vs RUA Explained
Use rua= in your DMARC record for monitoring. It delivers daily aggregate reports that show every IP sending mail from your domain, pass/fail counts, and spoofing activity. The other tag, ruf=, enables forensic reports for individual failures, but Gmail, Yahoo, and most major providers stopped sending them in 2023 over privacy concerns. For practical purposes, rua= is the only tag that reliably produces data.
RUA: Aggregate reports (the one you need)
RUA stands for "Reporting URI for Aggregate reports." When you set rua=mailto:reports@example.com, receiving mail servers send you a report once per day (usually 24 hours) summarizing all mail they received for your domain.
The report arrives as a gzipped XML file. It contains:
- Which IP addresses sent mail from your domain
- How many messages came from each IP
- SPF pass/fail counts
- DKIM pass/fail counts
- DMARC alignment status
- Which DMARC policy was applied (none, quarantine, reject)
It's volumetric. One file, thousands of messages. This is what you actually need to monitor.
For indie developers running a handful of domains, the aggregate report tells you everything: which IPs are yours, which are legitimate third parties, whether someone is spoofing your domain, and whether your SPF or DKIM setup is broken.
RUF: Forensic reports (the one that's dying)
RUF stands for "Reporting URI for Forensic reports." When you set ruf=mailto:forensics@example.com, receiving mail servers send you a separate report for each individual message that fails DMARC alignment.
Forensic reports use the AFRF format (Abuse Feedback Reporting Format, RFC 5965). They can include:
- Full message headers
- The message envelope
- Optionally, the full message body or a redacted version
The idea: you get pinged for each failure, with enough detail to see exactly what went wrong.
Sound useful? It used to be. Then the major mailbox providers stopped sending them.
Why Gmail and Yahoo stopped sending RUF
In 2023, Gmail stopped sending forensic reports. Yahoo followed. Most major providers have dropped RUF support entirely; privacy concerns are the stated reason. When you include a full message body in a forensic report, you're sending customer mail to a third party without explicit consent.
Now if you add ruf= to your DMARC record, you'll get very few forensic reports. Maybe some from corporate mail servers or smaller ESP providers that still support it. Don't count on it.
What this means for you
If you set both rua= and ruf= in your DMARC record:
v=DMARC1; p=none; rua=mailto:reports@dmarcdrift.com; ruf=mailto:forensics@example.com; fo=1
The rua= tag will generate reports reliably. The ruf= tag will almost certainly sit silent. You'll see mail from Gmail and Yahoo in your aggregate reports with failed alignment; but no forensic report because they don't send them.
You can still set ruf= to a mailbox you monitor, in case a smaller mail server sends one. But don't design any monitoring system around it. Forensic reports are noise in the modern email infrastructure.
The fo= tag: forensic report conditions
If you do set a ruf= address, the fo= tag controls when forensic reports are generated:
fo=0(default): Forensic reports sent when both SPF and DKIM fail alignmentfo=1: Forensic reports sent when either SPF or DKIM fails (more volume, less useful)fo=d: DKIM failures onlyfo=s: SPF failures only
Again: major providers don't use this. But if you're running your own mail server or depending on a smaller provider, this tag controls the threshold.
What you actually need to do
Set rua= to your DMARCdrift address so you receive aggregate reports. DMARCdrift turns the gzipped XML into a readable digest weekly, with alerts for real problems.
You can set ruf= if you want to see what forensic reports look like, but don't build your monitoring strategy around it. The aggregate report is your signal. Forensic reports are optional noise.
Start with the aggregate report. That's where the signal is.
Use the DMARC Record Checker to see your current DMARC configuration, then read the aggregate report guide to understand what data arrives once you enable rua=.