Read DMARC reports
Aggregate reports mailed to dmarc@ on a receiving domain, how they are checked, and the 30-day pass rate on each domain.
Mailbox providers that see mail from your domains send a daily DMARC aggregate report to the address in the domain's rua= tag: how many messages came from each sending address and whether SPF and DKIM passed and aligned. Minket reads them and shows a 30-day pass rate on each domain, which is what tells you a domain is ready to move from p=none to quarantine and then reject.
Where reports go
Reports go to dmarc@<receiving domain>. When a project has a receiving domain under the same registrable domain, the DMARC record Minket proposes for each new domain already points there:
_dmarc.mail.acme.example TXT "v=DMARC1; p=none; rua=mailto:dmarc@inbound.acme.example"A report about a domain in another registrable domain would need an authorization record in that domain's zone (RFC 7489, section 7.1), which the platform does not manage: give that domain its own receiving subdomain instead.
Mail to dmarc@ is not routed: it raises no email.received and no catch-all takes it. Add an exact rule for dmarc if an app should see those messages too.
What is accepted
Reports are untrusted input from anyone who can send mail, so a report is stored only when all of this holds:
- the report is a gzip, zip or XML attachment of at most 1 MB, at most 10 MB once decompressed (decompression stops at the limit, so a bomb costs nothing), and at most 3 are read per message;
- the XML has no
DOCTYPEand no entities other than XML's five and character references; it nests at most 16 levels, holds at most 200,000 elements and 10,000 rows; - SES saw the carrying message pass SPF or DKIM for a domain aligned with the reporter's, the domain of
report_metadata/email(google.comfornoreply-dmarc-support@google.com), so nobody can file reports in another provider's name; policy_published/domainis a domain of the project.
A message that fails a check shows dmarc_refused in its issues, and its routing entry says which check. A report sent twice (same domain, reporter and report_id) is stored once.
Pass rates
Each stored report keeps the reporter, report_id, its period, the published policy (p, sp, adkim, aspf, pct), the message count, how many passed DMARC (aligned DKIM or SPF), and the 200 largest sources (ip, count, disposition, spf, dkim). Read them with GET /v1/domains/{id}/dmarc:
curl https://api.minket.com/v1/domains/019a2b3c-4d5e-7f60-8a9b-0c1d2e3f4a5b/dmarc \
-H "Authorization: Bearer $MINKET_API_KEY"The domain's dmarc.pass_rate_30d (on the domain object and the domain page) is the share of messages that passed over the reports whose period ended in the last 30 days. Sources that fail are often a service sending in your name without DKIM: add its DKIM key or move it to a subdomain before tightening the policy.