Export reports and records
On every plan
On a domain's Reports page, press Export to reach Export this window. Choose what to export and press Start export. We build the file in the background and email you a link when it is ready. Any member can export, on every plan.
What goes in
The export covers the dates of the window the page shows, and only the From domain you chose, if you chose one. The reporter filter does not apply: an export takes whole days from every mailbox provider. To export a month, choose a month in Window first.
Choose a format
- Records as CSV, for a spreadsheet. Each row is one record of an aggregate report. A cell that a spreadsheet would read as a formula starts with an apostrophe, so opening the file runs nothing.
- Records as NDJSON, one JSON object per line, for another tool. The first line names the schema and the columns. The values are written exactly as stored.
- Report files in a zip, as we stored them. Tick which kinds go in: aggregate reports, TLS reports and forensic reports. Each kind has its own folder,
aggregate/,tls/andforensic/. Forensic reports come as.emlfiles, and only while the organization stores forensic reports in full.
Both record formats have these columns, in this order: date, report_id, reporter, source_ip, source_name, count, disposition, header_from, envelope_from, spf_aligned, dkim_aligned, dmarc_pass, eval_spf, eval_dkim, dkim_domains, spf_domain, override_reasons.
One export at a time
We build one export at a time for an organization, of any kind. That includes the archive of everything an admin starts on Settings → Data and privacy. While one is being built, the reports page says so. Start the next one when it is ready.
Download it
We email the link to the member who started the export. The link works for 7 days. Until then, the reports page also shows the domain's latest export, and any member can press Download the file there.
From a script
From Teams up, an API token that can write starts the same export, checks on it and downloads it. The API pages list what each answer means. A second export while one is running gets the export already running answer.
Published 27 October 2026 · Checked 27 October 2026