DMARC reports

A DMARC record can name an address (rua=) that receivers send aggregate reports to. DomainGuard hosts that address for you, receives the XML reports, and turns them into a list of who is sending as your domain and whether they pass.

Plan: Starter and up (dmarc_reports). On Free the record checks still run, and the Email module shows what Starter unlocks instead of an empty list. A Free account calling the report endpoints gets 402 plan_upgrade_required.

Your report address

Web: Monitor, DMARC, the inbox card. iOS: the DMARC page under Email & DMARC.
API/MCP: GET /api/dmarc/inbox, the tool get_dmarc_inbox.

The address is dmarc-<token>@nhmdmarc.com, unique to your account and shared by every domain on it. Put it in each domain's DMARC record as rua=mailto:…; the recommended DMARC record on every domain already includes it.

Because that address is on a different domain from yours, receivers require an authorization record on nhmdmarc.com before they will send to it. DomainGuard publishes and self-checks that record every five minutes, so the only thing you have to do is publish rua=.

What arrives

Aggregate reports are sent by receivers (Google, Microsoft, Yahoo and others) usually once a day. Each one names the reporter, the window, the policy they saw, and per sending IP: how many messages, and whether SPF and DKIM aligned. No message content is ever included.

The first report normally arrives within 24 to 48 hours of publishing the record.

Reading them

View	What it shows	Endpoint / tool
Summary	Report count, total messages, average pass rate over the last 30 days	`GET /api/dmarc/summary`, `get_dmarc_summary`
Senders	Every sending source: provider name where recognised, Known or Unknown, messages, passing, failing	`GET /api/dmarc/senders?days=30`, `get_dmarc_senders`
Reports	The raw list, newest first, per domain	`GET /api/dmarc/reports`, `list_dmarc_reports`
Upload	Paste or upload an XML report you received elsewhere	`POST /api/dmarc/reports`

"Unknown" senders with real volume are the thing to look at: either a service someone signed up for that is not in SPF, or someone forging you.

Rotating the address

POST /api/dmarc/rotate (the Rotate button, or the rotate_dmarc_inbox tool) issues a new address and retires the old one. Every domain's DMARC record then has to be updated, so the tool asks for confirmation, and a rotation is refused within 24 hours of the last one.

DMARC alerts

The alert cron runs every five minutes for accounts with email alerts (Starter and up) and reads the record state off the newest scan, never a second DNS lookup:

Trigger	Channel	Cooldown
A new sender with at least 5 unauthenticated messages	One batched email and one push per account	Once per sender ever; at most one email per account per 6 hours
The `_dmarc` record disappeared	Email and push	Once per transition; a reminder after 7 days
Policy downgraded (`reject` to `quarantine` or `none`, or unreadable)	Email and push	Once per transition; again if it falls further
Record or policy restored	Email and push; the alert clears	Once

Switches: DMARC alerts push and email under Notification settings.

Common questions

No reports after a week. See No DMARC reports are arriving. The usual causes are rua= pointing elsewhere, a typo in the address, or the record being on a subdomain.

Do I need one address per domain? No. One address per account; the report names the domain it is about.