Free toolNo sign-up
DNS Lookup
Use Sendmarc's DNS lookup tool to instantly analyze domain records, verify configurations, and detect DNS issues for better performance.
Blog article
- 8 minutes read
Kiara SaloojeeDMARC EnthusiastDMARC Forensic Reports: What They Are and How To Use Them
DMARC forensic reports give security teams per-message visibility into emails that fail DMARC authentication. Where aggregate reports summarize authentication results across all traffic, DMARC forensic reports – also called RUF reports – provide details on individual failing messages.
That distinction matters when you need to investigate a specific spoofing attempt, diagnose a misconfigured sender, or build an audit trail for compliance purposes.
To receive forensic reports, add the ruf= tag to your DMARC record. This tag specifies the mailbox where receiving servers should send reports when a message fails DMARC.
See how Sendmarc gives your team unified visibility into DMARC authentication failures.
How DMARC Forensic Reports Work
When a receiving server detects a DMARC failure, it generates a per-message report and sends it to the address specified in your ruf= tag. DMARC forensic reports use the Abuse Reporting Format (ARF), an industry-standard format for reporting email abuse.
Each report can include:
- Message headers
- The sending address
- Authentication results (SPF and DKIM)
- Time of reception
- DKIM signature
- Sending host
- Subject line
- Message ID
The fo= tag controls when reports are generated:
| Tag value | When a report is sent |
|---|---|
fo=0 | Only when both SPF and DKIM fail |
fo=1 | When either SPF or DKIM fails |
fo=d | On DKIM failures only |
fo=s | On SPF failures only |
One important limitation: Not all receiving servers send DMARC forensic reports. Support is inconsistent across providers, and some major providers – including Gmail – don’t send RUF reports. This means forensic report data will never be complete. Use it alongside aggregate report data, not as a replacement for it.
DMARC Forensic Reports vs. Aggregate Reports
Understanding when to use each report type helps security teams get the most from their DMARC configuration.
| Report type | Trigger | Scope | Content | Best for |
|---|---|---|---|---|
| Aggregate reports | Time-based (typically every 24 hours) | All email traffic | Volume, pass/fail rates, sending sources | Ongoing monitoring and policy enforcement |
| Forensic reports | Per message failure | Individual failing messages | Headers, authentication results, message details | Investigating specific failures and spoofing attempts |
Aggregate reports are the primary tool for day-to-day visibility and policy enforcement. Forensic reports are most useful when aggregate data surfaces a problem, but doesn’t explain it.
You can configure both in a single DMARC record:
| Host | Type | Value |
|---|---|---|
_dmarc.yourdomain.com | TXT | v=DMARC1; p=reject; rua=mailto:[email protected]; f ruf=mailto:[email protected]; fo=1; |
Privacy Considerations for DMARC Forensic Reports
Forensic reports can contain sensitive message content, including headers, subject lines, and, in some cases, body text from emails that failed DMARC. This creates data handling obligations that vary by region and industry.
Organizations subject to GDPR or similar privacy regulations should assess whether enabling ruf= is appropriate before doing so. If forensic reports capture personal data from third-party emails, that data must be handled in line with the applicable law.
Before enabling forensic reporting:
- Confirm your legal basis for collecting and processing report data
- Ensure the reporting mailbox is access-controlled and appropriately secured
- Review your data retention obligations for report content
Note that some receiving servers redact sensitive fields – such as body content, which can reduce the privacy risk but also limit the detail available for investigation.
Acting on Forensic Report Data
DMARC forensic reports are most useful when treated as part of an investigation. They help you:
- Investigate unfamiliar sending IPs. If a forensic report includes a sending IP you don’t recognize, check whether it’s an unauthorized sender or a legitimate service that isn’t correctly configured. Unauthorized senders should be removed or blocked; legitimate senders need to be authorized in your SPF and DKIM configurations.
- Diagnose the authentication failure. The authentication results in each report show whether the failure was caused by SPF or DKIM issues, or both. This determines what needs to be fixed.
- Build audit trails. Forensic report data supports internal investigations and provides credible evidence to audit and risk committees.
Parsing and acting on forensic report data manually isn’t practical. A DMARC management platform parses and surfaces forensic report data across all your domains, so your team can investigate faster.
Unified Visibility Into DMARC Reporting
DMARC forensic reports surface details that aggregate data alone can’t provide. They identify specific authentication failures and give security teams the visibility needed to investigate spoofing attempts, eliminate unauthorized senders, and support compliance reporting.
Managing forensic report data across multiple domains requires more than a reporting mailbox. Sendmarc’s DMARC Management solution gives teams unified visibility into authentication failures, sending sources, and DMARC compliance.
Sendmarc provides:
- Aggregate and forensic reporting in a single dashboard
- Identification of unauthorized or unknown email senders
- Continuous monitoring without increasing internal workload
- Audit trails to support compliance and governance requirements
See how Sendmarc gives your team unified visibility into DMARC reporting.
DMARC Forensic Reports: How To Read and Act on Them
Get the latest email security updates delivered to your inbox each month
Is Your Domain Protected?
Get your domain’s security score in seconds.
Check your impersonation, privacy, and branding ratings.
If you’re at risk of impersonation, one of our experts will be in touch to assist.
