DMARC Lookup Articles

Try the DMARC Lookup
Why DMARC Forensic Reports Are Almost Never Deployed — ruf=, Privacy, and the pct= Gradual Rollout Strategy

Why DMARC Forensic Reports Are Almost Never Deployed — ruf=, Privacy, and the pct= Gradual Rollout Strategy

DMARC forensic reports (ruf=) send full copies of failing messages to a specified inbox — which means receiving copies of phishing emails, confidential business email, and PII. Here's why ruf= is almost never deployed (Google and Microsoft don't send them, privacy obligations, volume), how the pct= percentage tag enables gradual p=reject rollout, and why external third-party DMARC reporting services need DNS verification before they can receive your reports.

Jul 3, 2026
What DMARC Aggregate Reports Actually Tell You — and How to Turn Raw XML Into an Authorized Sender Inventory

What DMARC Aggregate Reports Actually Tell You — and How to Turn Raw XML Into an Authorized Sender Inventory

DMARC aggregate reports arrive as zipped XML — effectively unreadable without tooling — and the organizations generating the most complex reports are exactly those with the most to learn from them. Here's what each field in an aggregate report actually tells you, the two-type categorization of findings (legitimate-unauthenticated vs hostile), the recommended inventory-building process before moving to p=reject, and how third-party DMARC reporting services make this data actionable.

Jun 19, 2026
DMARC for Domains That Never Send Email: Why p=reject Can (and Should) Be Immediate

DMARC for Domains That Never Send Email: Why p=reject Can (and Should) Be Immediate

A domain that never sends email is, paradoxically, an easy spoofing target — recipients have no way to know "this domain never sends mail" without DMARC explicitly saying so. Here's why p=reject can be applied immediately (with zero risk) to parked/non-sending domains and subdomains, how sp= protects subdomains separately from the primary domain's policy, and why BIMI specifically requires p=quarantine or p=reject, not p=none.

Jun 19, 2026
DMARC Alignment: Why SPF and DKIM Can "Pass" While DMARC Still Fails

DMARC Alignment: Why SPF and DKIM Can "Pass" While DMARC Still Fails

"SPF passes" and "DKIM passes" don't mean DMARC passes — DMARC additionally requires alignment between the visible From domain and the domain that actually passed SPF or DKIM. Here's the distinction between envelope sender and visible From, relaxed vs strict alignment, and why DMARC passes if EITHER SPF or DKIM is aligned — the key to debugging most DMARC failures with third-party senders.

Jun 16, 2026