What data DMARCdrift receives
What DMARC aggregate reports contain, what they don't contain, and how DMARCdrift's inbound report addresses work.
DMARCdrift receives DMARC aggregate reports on your behalf. Understanding what's in these reports — and what isn't — helps you interpret the data in your dashboard and understand DMARCdrift's privacy model.
What an aggregate report contains
DMARC aggregate reports are XML documents sent by email receivers (Google, Microsoft, Yahoo, and others) to the rua= addresses in your DMARC record. Each report covers a time period (usually 24 hours) and contains:
Per-source records, each with:
- Source IP address
- Message count from that IP during the period
- SPF result (pass/fail) and the envelope sender domain that was evaluated
- DKIM result (pass/fail) and the signing domain (
d=value) from any DKIM signature - DMARC disposition (none/quarantine/reject)
- Whether SPF and DKIM produced alignment
Metadata:
- Reporting organization name and email
- The domain the report covers
- Report time range (begin and end timestamps)
- The DMARC policy that was in effect at evaluation time
What an aggregate report does not contain
Aggregate reports are designed to provide statistical data without exposing message content or recipient information. They do not contain:
- Message subject lines, body content, or attachments
- Recipient email addresses
- Sender email addresses (the
From:header) - Message IDs or timestamps for individual messages
- Any personally identifiable information about senders or recipients
The smallest unit of data in an aggregate report is a group of messages from a single IP during a single reporting period. You cannot identify individual emails from aggregate report data.
How your inbound address works
Each domain you add to DMARCdrift receives a unique inbound reporting address: d-abc123@in.dmarcdrift.com. The exact address is derived from the domain's internal ID.
When a receiver sends a report, it arrives as an email with a gzipped XML attachment. DMARCdrift receives it, validates the signature, decompresses the attachment, parses the XML, and stores the structured record data. The raw XML is not stored after processing.
The inbound address is specific to your domain. If you remove the domain and re-add it, the address changes. Any reports sent to the old address after removal are discarded.
Who sends aggregate reports
Not every receiver sends reports. The major reporters you'll typically see data from:
- Google (
noreply-dmarc-support@google.com): covers Gmail recipients - Microsoft (
dmarcreport@microsoft.com): covers Outlook, Hotmail, Live - Yahoo (
dmarc_rua@yahoo-inc.com): covers Yahoo Mail - Apple (
postmaster@apple.com): covers iCloud Mail
Smaller mail providers, corporate mail servers, and regional ISPs may also send reports, but less consistently. Coverage depends on which receivers handled mail sent to your domain during the reporting period.
Report frequency
Most major receivers send one aggregate report per 24-hour period. Reports typically arrive within 24-48 hours of the period they cover. Some receivers are slower; occasional 48-72 hour delays are normal.
A domain that sent no email during a period may receive no reports for that period — receivers don't send empty reports.
See also: When reports start arriving: timing expectations after publishing your DMARC record. Report history and data retention: how long processed report data is stored.