DMARC reports are the only honest deliverability dashboard

A DMARC rua address receives XML reports from receivers describing every message they saw claiming to be from your domain: source IP, alignment result, and the policy action taken. It is unglamorous, it is the only data that comes from the receiver's side, and almost nobody reads it.

What a report actually contains

Each record aggregates a window of messages by source IP and disposition. For every entry you get the count, the SPF and DKIM results, and whether the header From domain aligned. Alignment is the part people miss: a message can pass SPF for a different domain and still fail DMARC, because DMARC checks the From header, not the envelope.

The first thing to look for

Sources you do not recognise sending as your domain. That is either a forgotten SaaS tool or somebody spoofing you. Both are worth knowing. The second thing is your own legitimate sources failing DKIM because a selector was rotated and the DNS record was not updated — a silent failure that only shows up here.

Start at p=none and actually read it

p=none collects reports without affecting delivery. The mistake is leaving it at none forever, or jumping to reject the same week. Move to quarantine once every legitimate source shows aligned pass, then to reject after a clean month.

One practical detail

Reports arrive as attachments (often gzipped XML) at the address in the rua tag. That address receives mail from every large receiver, including ones that send a lot of it. Point it at a mailbox with a retention policy, not at a human's inbox.

Volanea surfaces DMARC pass and fail rates per sending domain alongside the send log, so the report data and the actual sends can be read together.