What a report does not contain

After this lesson you can

State the questions aggregate reports can answer and the ones they never will.

Assumes you have read Every tag, including the unused ones.

Aggregate reports are counts grouped by sending IP and authentication outcome. Knowing precisely what is not in them stops you building an investigation on evidence that does not exist.

What is in one

per reporting receiver, per day:
  - the policy they found and applied
  - rows, each: source IP, message count, disposition,
    DMARC pass/fail for SPF and DKIM, the domains
    that were evaluated, and the selector

What is not

Absent	Consequence
Recipient addresses	You cannot tell who was targeted, or contact them.
Subject lines and message bodies	You cannot tell a phishing campaign from a broken newsletter by content.
Message-IDs or timestamps	Rows cannot be matched to individual messages in your own logs.
Mail that was never sent to a DMARC-reporting receiver	Your view is of participating receivers only, and they are not all of the internet.
Anything about mail that passed at a receiver that does not report	Volumes are lower bounds, never totals.

The reports are deliberately unable to identify a person. That is what makes them publishable to a third-party processor without a privacy review, and it is the direct cause of every question they cannot answer.

Questions they do answer

What is sending as my domain? By IP, comprehensively, including systems nobody remembers.
Is a given sender aligned? Per mechanism, per source.
Is my pass rate improving? Over time, per sending source.
What policy do receivers think I published? Which catches a record that is not what you believe it is.

Questions they do not

Who received the spoofed mail? Never available.
What did it say? Not without a failure report, which you will almost certainly not receive.
Did my customer get their receipt? Delivery is not what DMARC reports on.
Is this IP an attacker or a forwarder? Frequently ambiguous, and the reports do not resolve it.

Volumes are relative, not absolute

A source appearing with 4,000 messages did not send 4,000 messages. It sent at least that many to receivers that report. Comparing two sources in the same report is sound; comparing a report total to your own send volume is not.

Knowledge check

A spoofing campaign shows up in your reports. What can you tell the affected customers?

Nothing specific — the reports contain no recipient addresses, so you cannot identify who was targeted.
The subject lines used, so they know what to watch for.
Exactly how many messages reached them.
The time each message arrived, from the report timestamps.

Correct — Nothing specific — the reports contain no recipient addresses, so you cannot identify who was targeted. The absence of recipient data is deliberate and is what makes the reports shareable with a processor at all. You can act on the source and tighten policy; you cannot notify individuals from this evidence.

Not this — The subject lines used, so they know what to watch for. Aggregate reports carry no message content. A failure report might, and almost no receiver sends them.

Not this — Exactly how many messages reached them. Counts are per reporting receiver and represent a lower bound across participating receivers only. They cannot be attributed to any recipient.

Not this — The time each message arrived, from the report timestamps. A report covers a period, usually a day. There are no per-message timestamps to draw on.

Last reviewed 2026-09-15

What a report does not contain

What is in one

What is not

Questions they do answer

Questions they do not

Try it on a real domain