Choose how forensic reports are stored

On every plan

A forensic report is a copy of one message that failed DMARC, so it can hold people's email addresses and the message's subject. An admin chooses how we store them, under Settings, Organization. By default we remove the personal data and delete the original message. You can also keep them in full, or not keep them at all.

When you get them

You get forensic reports only when your domain's DMARC record asks for them with ruf=. The record builder on the domain's Records tab leaves ruf= out unless you ask for it (the settings you can change). Even then, few mailbox providers send them. Google and Microsoft do not.

Make the choice

Open Settings, then Organization. Only admins see this page.
Under Forensic reports, choose one:
- Store with personal data removed, the default. We keep the report's details, such as when the message arrived, the IP address that sent it, which check failed and what the mailbox provider did with the message. We remove the personal data as the next section describes, and delete the original message as soon as the report is stored.
- Store in full. We keep the report as it arrived, and the original message with it. Each report's page then has a Download the report message button.
- Do not store forensic reports. We keep neither the report nor the message.
Select Save.

The choice covers every domain in the organization. Each domain's Forensic page says which choice is in force. Every member can read the reports there. Only an admin can change the choice.

What "personal data removed" means

Every email address keeps its domain, and the part before the @ becomes ***. In the From, To, Cc, Reply-To and Return-Path headers, the display names are removed too.
The subject is removed.
Only the original message's headers that help find the cause of the failure stay, such as Received, Authentication-Results and DKIM-Signature. Every other header is dropped.
The original message, body and all, is deleted. We keep no copy with the personal data in it.

What a change does to reports already stored

A new choice applies to the reports you already have, not only to the ones that arrive later:

From Store in full to Store with personal data removed: we remove the personal data from every stored report and delete their original messages.
To Do not store forensic reports: we delete every stored forensic report.
From Store with personal data removed to Store in full: only reports that arrive from then on are kept in full. The original messages of earlier reports were deleted when they arrived, and they cannot come back.

Before you save, the page lists what each other choice would do to the reports stored now, with their number. The change runs in the background once you save. Backups that still hold what was deleted are replaced within 30 days.

How long they stay

Forensic reports follow your plan's history, like every other report. Each night we delete the ones older than it.

Whose data it is

For forensic reports, you are the controller of the personal data in them, and we process it on your behalf. The privacy policy says the same.

Forensic reports are never forwarded. The relay sends on aggregate and TLS reports only, whatever you choose here.

Published 27 October 2026 · Checked 27 October 2026