DMARC reports
Every day, Gmail, Microsoft, Yahoo and other mailbox providers can send the owner of a domain a report: every service that sent mail as that domain, how much, and whether it passed DKIM and SPF alignment. mxAURA gives each account its own address to receive them, and Radar reads them.
Setting it up
- Open Settings, Integrations, DMARC reports and press Copy address.
- In your DNS, open the TXT record at
_dmarc.yourdomain.com. Add the address to itsrua=tag. If there is already an address there, keep it and add this one after a comma:rua=mailto:existing@example.com,mailto:followed by the address you copied. Keep yourp=policy as it is. - Do the same for each domain you send from. Reports start within a day or two.
Uploading reports instead
No access to the DNS, or reports already sitting in a mailbox? Drag the files onto the DMARC reports card, or press Upload reports: the .xml, .xml.gz or .zip attachments exactly as the providers send them, up to 20 at a time, 10 MB each. They are read the same way as reports that arrive by email, and a report already in is not counted twice. The address is then optional: it only makes reports arrive on their own.
After an upload
The card lists each file under Just uploaded: its domain, the provider that reported it, the days it covers, the messages in it, the share that passed DMARC, and how many failed or were quarantined. A file already uploaded says so and is not counted twice; one that could not be read says why.
Below that, Who sends as your domains lists every sending source: domain, service, messages, the share that passed DMARC, DKIM and SPF alignment, quarantined or rejected, and last seen. Rows with failures are tinted. Choose the last 30 days, 90 days or the last year; after an upload the card widens itself to include the dates of what you uploaded. When reports exist but none fall in the range, the card says Reports on file and when the latest one is from, instead of Not receiving yet.
What Radar does with them
- Ask can answer "who sends as our domain, and does it pass?" per domain and service: HubSpot, Google, Microsoft 365, or whatever domain signed the mail.
- Findings flags a sender first seen in the last week whose mail mostly fails both DKIM and SPF alignment: either a service of yours that needs its DKIM set up, or someone sending as your domain without permission.
Reports are only counted. Nothing in them is opened, followed or answered.