How to read DMARC reports without guessing

Identify the report’s scope

The current aggregate-reporting specification describes XML reports containing authentication and policy-related data. Begin with the reporting organization, time range and domain. Do not combine overlapping reports and assume the resulting sum represents unique delivered messages.

Triage senders with a simple worksheet

Our proposed triage order prioritizes operational context. An unfamiliar source is a question to investigate, not immediate proof of malicious activity.

Classification	Evidence to collect	Next action
Known service, expected result	Service owner and recent configuration	Keep a baseline.
Known service, unexpected failure	Headers and recent platform changes	Escalate to the technical owner.
Unrecognized source	Inventory history and message context	Investigate before authorizing.
Unclear or incomplete data	Reporting period and parsing issue	Do not make a policy decision yet.

Separate alignment from message disposition

Authentication-related results and the handling reported by a receiver are distinct fields. A report does not tell you that every accepted message was placed in the inbox. Check the current specification and your parser’s documentation when a label is unclear.

Handle reports as operational data

Keep reports in an access-controlled location. Before using a third-party analyzer, review its data handling and what is uploaded. GlockApps offers a DMARC Analyzer; we have not tested its parsing or independently audited its retention. Do not post raw operational reports in public comments.

A question worth asking

Do DMARC reports show open rates or inbox placement?

No. They describe authentication and policy-related observations, not subscriber engagement or a comprehensive record of inbox placement.

Sources and scope

Checked: Public documentation linked below and the decision framework described on this page.

Not independently tested: Product accuracy, paid account workflows, support or delivery outcomes.

Reader should verify: Current terms and suitability for the actual sending setup. Never change production DNS from a generic example.

Last checked: September 2026.

Continue your investigation

Choose the next guide for the question that remains unanswered:

Visit GlockApps — partner site

Partner link. Conditions can change; testing does not guarantee delivery.