What are these DMARC report emails, and are they spam?
These emails are DMARC aggregate reports. Mailbox providers such as Google, Microsoft and Yahoo send them, usually once a day, to the address in the rua= tag of your domain's DMARC record. Each one counts the mail the provider received in your domain's name, and whether it passed SPF, DKIM and DMARC. They are not spam or a complaint, and they ask nothing of you. To stop them, change the rua= tag. To read them, unpack the attached file, or let a service read them for you.
What they look like
These are real report emails that Google, Microsoft and Yahoo sent about the IETF's domains, which the IETF publishes in its mail archive. Here example.com stands in for the IETF's domain. In the archive every subject starts with [Dmarc-report]. The IETF's mailing list adds that tag, so the report emails you receive do not have it.
- Google sends from
noreply-dmarc-support@google.com. The subject isReport domain: example.com Submitter: google.com Report-ID: 11851910314568034957. The message has no text, only a.zipfile:google.com!example.com!1792886400!1792972799.zip. - Microsoft sends from
dmarcreport@microsoft.com, under the name "DMARC Aggregate Report". The subject isReport Domain: example.com Submitter: protection.outlook.com Report-ID: 4e728673013c4a72b1cb226eed240420. Some subjects nameenterprise.protection.outlook.cominstead and start with[Preview]. The message's text says it is a DMARC aggregate report from Microsoft for the period it names. It says you receive it because your address is in theruatag, and that you can remove the address there to stop it. It also says the mailbox is not monitored. The file is.xml.gz:protection.outlook.com!example.com!1792886400!1792972800.xml.gz. - Yahoo sends from
noreply@dmarc.yahoo.com. The message's text says it is an aggregate DMARC report from Yahoo for your domain, and that you receive it because your address is in theruatag of the domain's DMARC record. To stop the reports or send them elsewhere, it tells you to change that tag through your email, domain or hosting provider, and says Yahoo cannot help with your DNS. It says the sending mailbox is not monitored, and givesdmarchelp@yahooinc.comfor feedback and questions. The submitter is one of Yahoo's own domains, such asyahoo.fr. The file is.xml.gz:yahoo.fr!example.com!1792886400!1792972799.xml.gz.
The subject and the file name follow RFC 9990, the standard for these reports. After "Report Domain" comes the domain the report is about, and after "Submitter" the mailbox provider that wrote it. The file name holds the same two names, then the start and end of the period the report covers, counted in seconds from 1 January 1970 UTC. All three examples cover 25 October 2026. The standard asks for a gzip file, .xml.gz, or plain XML. Google sends a .zip instead.
Are they spam?
No. They arrive because your domain's DMARC record asks for them. The record is a line of text at _dmarc.example.com in your DNS, and its rua= tag names the address:
v=DMARC1; p=none; rua=mailto:dmarc@example.com
Someone published that record, perhaps on the advice of an email service's setup guide, and the address in it now receives the reports.
A report is not a complaint and not a demand. It counts all the mail sent in your domain's name, passing and failing, and holds no message content. Google describes each row as the number of messages from one IP address, their SPF, DKIM and DMARC results, and what the receiving server did with them. The report emails above ask you for nothing. Google's has no text at all, and Microsoft's and Yahoo's explain why you receive them and how to stop them. A message that asks you to click a link, sign in or pay is not a DMARC report.
Both Google and Microsoft advise against receiving them in a person's mailbox. Google writes, "We don't recommend using your own email address." Microsoft says to use a dedicated mailbox or group and "don't deliver the reports to a user's mailbox".
How to stop them
The reports go wherever rua= points, so the change is made in your DNS, in the record at _dmarc.example.com. Whoever looks after your DNS can make it: the agency that built your website, your IT contact or the company you bought the domain from.
- Send them somewhere else. Replace your mailbox's address with a shared mailbox, or with the address of a service that reads reports. They stop reaching you, and the reports keep coming.
- Stop them altogether. Remove the
rua=tag. Nobody gets reports any more, and you lose the one view you have of who sends mail in your domain's name.
Change only the rua= tag. Deleting the whole record also deletes your policy, and the largest mailbox providers ask bulk senders to have one: see What Google, Yahoo and Microsoft ask of senders. Marking the emails as spam, or filtering them, only moves them. The record still asks for them.
Why some mailbox providers send none
Not every mailbox provider sends reports. Microsoft 365 sends them only for organizations whose MX record points straight to Microsoft 365, so mail to a company that has a separate mail filter in front of it appears in no report from Microsoft. Neither Google nor Microsoft sends forensic reports, the per-message reports a ruf= tag asks for. Google's words are "Gmail doesn't support the ruf tag".
How to read them
Unpack the attached file. Inside is one XML file. Each <record> in it is one sending IP address, with a message count and its results:
<record>
<row>
<source_ip>192.0.2.10</source_ip>
<count>12</count>
<policy_evaluated>
<disposition>none</disposition>
<dkim>pass</dkim>
<spf>fail</spf>
</policy_evaluated>
</row>
<identifiers>
<header_from>example.com</header_from>
</identifiers>
</record>
An IP address does not say which service sent the mail, and a new file arrives every day from each provider. Microsoft calls the data "vast and difficult to parse". Google suggests turning the records into a table, or using a service that reads them.
To have the reports read for you, add your Mailmoni reporting address to rua=, and we name the service behind each address where we can.