# Read DMARC reports

> Aggregate reports mailed to dmarc@ on a receiving domain, how they are checked, and the 30-day pass rate on each domain.

Source: https://docs.minket.com/dmarc/
Updated: 2026-10-29

Mailbox providers that see mail from your domains send a daily DMARC aggregate report to the address in the domain's `rua=` tag: how many messages came from each sending address and whether SPF and DKIM passed and aligned. Minket reads them and shows a 30-day pass rate on each domain, which is what tells you a domain is ready to move from `p=none` to `quarantine` and then `reject`.

## Where reports go

Reports go to `dmarc@<receiving domain>`. When a project has a receiving domain under the same registrable domain, the DMARC record Minket proposes for each new domain already points there:

```
_dmarc.mail.acme.example  TXT  "v=DMARC1; p=none; rua=mailto:dmarc@inbound.acme.example"
```

A report about a domain in another registrable domain would need an authorization record in that domain's zone (RFC 7489, section 7.1), which the platform does not manage: give that domain its own receiving subdomain instead.

Mail to `dmarc@` is not routed: it raises no `email.received` and no catch-all takes it. Add an exact rule for `dmarc` if an app should see those messages too.

## What is accepted

Reports are untrusted input from anyone who can send mail, so a report is stored only when all of this holds:

- the report is a gzip, zip or XML attachment of at most 1 MB, at most 10 MB once decompressed (decompression stops at the limit, so a bomb costs nothing), and at most 3 are read per message;
- the XML has no `DOCTYPE` and no entities other than XML's five and character references; it nests at most 16 levels, holds at most 200,000 elements and 10,000 rows;
- SES saw the carrying message pass SPF or DKIM for a domain aligned with the reporter's, the domain of `report_metadata/email` (`google.com` for `noreply-dmarc-support@google.com`), so nobody can file reports in another provider's name;
- `policy_published/domain` is a domain of the project.

A message that fails a check shows `dmarc_refused` in its `issues`, and its routing entry says which check. A report sent twice (same domain, reporter and `report_id`) is stored once.

## Pass rates

Each stored report keeps the reporter, `report_id`, its period, the published policy (`p`, `sp`, `adkim`, `aspf`, `pct`), the message count, how many passed DMARC (aligned DKIM or SPF), and the 200 largest sources (`ip`, `count`, `disposition`, `spf`, `dkim`). Read them with `GET /v1/domains/{id}/dmarc`:

```sh
curl https://api.minket.com/v1/domains/019a2b3c-4d5e-7f60-8a9b-0c1d2e3f4a5b/dmarc \
  -H "Authorization: Bearer $MINKET_API_KEY"
```

The domain's `dmarc.pass_rate_30d` (on the domain object and the domain page) is the share of messages that passed over the reports whose period ended in the last 30 days. Sources that fail are often a service sending in your name without DKIM: add its DKIM key or move it to a subdomain before [tightening the policy](https://docs.minket.com/domains/#dmarc-staged).