DMARC (Domain-based Message Authentication, Reporting & Conformance) is an email authentication protocol that lets domain owners tell receiving mail servers what to do when an email fails SPF or DKIM checks. Aggregate reports give you visibility into who is sending email on behalf of your domain, and how much of it is passing authentication.

Plan Limits

DMARC reporting is available on all plans. The number of monitored domains varies by plan:

A “DMARC domain” is any unique sending domain for which you have configured a rua= address pointing at Spamurai. Reports from additional domains beyond your plan limit are silently discarded.

How It Works

When a receiving mail server processes an email claiming to be from your domain, it checks:

1. SPF Does the sending IP match the list of allowed senders in your DNS TXT record?
2. DKIM Is there a valid cryptographic signature from your domain in the email headers?
3. DMARC alignment Does the From: domain align with the domain that passed SPF or DKIM?

If the email passes either SPF or DKIM (with alignment), it is DMARC-compliant. If both fail, the DMARC policy determines what happens: none (monitoring only), quarantine (send to spam), or reject (discard).

Mail servers that support DMARC can send aggregate reports (RUA) to an address you specify in your DNS record. Spamurai receives these reports and presents them as charts and tables.

Setting Up Reporting

Go to DMARC → Setup to get your organisation’s RUA address. Add it to your domain’s DMARC DNS record:

_dmarc.example.com  IN  TXT  "v=DMARC1; p=none; rua=mailto:your-slug@reports.example.com"

Reports are sent by receiving mail servers daily. You should start seeing data within 24–48 hours of adding the rua= tag.

Policy Progression

Start with p=none while you monitor. Once your compliance rate is consistently high (95%+), move to quarantine, then reject.

Moving too quickly to reject can disrupt legitimate mail from marketing tools, CRMs, or third-party senders. Use the Reports charts to understand all sending sources before tightening the policy.

The Reports Dashboard

The main DMARC dashboard (DMARC → Reports) is a messaging analytics view built from every aggregate report you’ve received. Charts share a time range selector — 1D, 7D, 2W, 30D, 90D, or a custom “from date” and update together when you change it. Any chart can be zoomed (mouse wheel or pinch) and panned along the time axis, with a reset-zoom button appearing once you do; click the expand icon on a chart’s header to open it full-size in a modal.

Charts on the dashboard:

• Message volume Total messages received per day, as a bar chart.
• SPF & DKIM alignment Percentage of messages passing SPF and passing DKIM over time, as two lines. Useful for spotting the moment a key rotation or SPF record change broke authentication.
• Disposition Stacked daily bar chart of what receivers did with your mail: none, quarantine, reject.
• DMARC compliance rate over time Percentage of messages passing DMARC (DKIM or SPF pass, with alignment) per day.
• Pass rate by domain One line per monitored domain, so you can compare compliance across domains at a glance when you have multiple.
• Top failing IPs Source IPs where both DKIM and SPF are failing, ranked by volume. These are the highest-risk senders.
• Global message distribution World choropleth map of message volume by source country.
• Top sending countries The same geographic data as a ranked bar chart.
• Authentication results Doughnut breakdown of every message into: both DKIM+SPF pass, DKIM fail/SPF pass, DKIM pass/SPF fail, likely forwarded, and both fail (DMARC fail). “Likely forwarded” isolates messages that failed SPF but look like they passed through a forwarder rather than a spoofer.
• Top sending IPs All source IPs ranked by message volume, not just failing ones.
• Top sending domains header_from domains appearing most frequently in reports.
• Top reporters Which mail providers are sending you aggregate reports (Gmail, Outlook, Yahoo, etc.), ranked by report count.
• Top sending networks (ASN) Autonomous system organisations (e.g. Google LLC, Amazon) sending on your behalf. Useful for identifying unexpected cloud or SaaS senders.

Use Export JSON to download the underlying report data, or filter to a single domain with the domain selector — every chart and the diagnostic report below scope to that filter.

Reading a Report

Click any report in the table to open the detail view. Each report covers a 24-hour window from a single reporting organisation.

The compliance bar at the top of the detail view shows the aggregate pass/fail split for the entire report at a glance.

Message Logs

Go to DMARC → Message Logs to search the raw, per-source-IP records behind your aggregate reports, one row per source IP within a report, rather than one row per report.

Filter by any combination of:

Each result row links to the full report it came from. Use Export CSV to download the current filtered results (up to 10,000 rows), handy for sharing with a mail provider or archiving outside your configured retention window.

Blacklist Status

If a source IP in your message logs is also an IP you monitor with a DNSBL check, the row shows a badge with that check’s most recent blocklist status — Listed X/Y (red) or Not Blacklisted (green), linking to the check itself. This only appears for IPs you actually monitor; it does not run new blocklist lookups against arbitrary senders in your DMARC data.

AI Diagnostic Report

The Diagnostic Report button on the DMARC Reports page downloads a structured Markdown file summarising your current DMARC health. It is designed to be pasted directly into an AI chat (Claude, ChatGPT, etc.) for instant expert diagnosis without any manual copy-pasting of data.

The report includes:

• Policy settings your current p=, sp=, adkim=, aspf=, and pct= values
• Authentication breakdown total message counts and percentages for every pass/fail combination (DKIM only, SPF only, both, likely forwarded)
• Top failing IPs source IPs where both DKIM and SPF failed, aggregated across all reports
• Top sending ASNs and domains who is sending on your behalf and how much
• Geographic distribution top countries by message volume
• Reporting organisations which mail providers sent you reports
• Failing records detail every unique failing sender with full authentication context: DKIM domain, selector, SPF domain, reverse DNS, ASN, and disposition

The report ends with a pre-written prompt instructing the AI to identify root causes, flag suspicious senders, suggest specific DNS fixes, and rate your overall DMARC health.

If you have filtered the dashboard to a specific domain, the Diagnostic Report button automatically scopes the report to that domain.

Compliance Alerts

You can configure Spamurai to send you a notification when the DMARC compliance rate in a report drops below a threshold you set. This catches sudden changes for example, a domain signing key rotation that broke DKIM, or a new sending source that wasn’t set up correctly.

Go to DMARC → Reports and open the Alert Settings card to configure:

Alerts are sent to all owner members of your organisation via your configured notification channels.

Data Retention

Raw per-record DMARC data (the rows behind Message Logs and individual reports) is kept for 90 days by default, then deleted by a daily cleanup job. This does not affect your compliance history daily/domain rollups are kept indefinitely and continue to power the Reports dashboard’s long-term trend charts regardless of the raw-record retention window.

If you need raw records kept longer (or shorter) than the default 90 days, contact hello@seabhac.io retention is configured per organisation on request.

Glossary