DMARC reports

A DMARC record can name an address (rua=) that receivers send aggregate reports to. DomainGuard hosts that address for you, receives the XML reports, and turns them into a list of who is sending as your domain and whether they pass.

Plan: Starter and up (dmarc_reports). On Free the record checks still run, and the Email & DMARC screen shows what Starter unlocks instead of an empty list. A Free account calling the report endpoints gets 402 plan_upgrade_required.

Your report address

Web: Settings, Profile, Email authentication (DMARC); a domain's Email & DMARC tab shows the reports. iOS: the DMARC page under Email & DMARC.
API/MCP: GET /api/dmarc/inbox, the tool get_dmarc_inbox.

The address is dmarc-<token>@nhmdmarc.com, unique to your account and shared by every domain on it. Put it in each domain's DMARC record as rua=mailto:…; the recommended DMARC record on every domain already includes it.

Because that address is on a different domain from yours, receivers require an authorization record on nhmdmarc.com before they will send to it. DomainGuard publishes that record and re-checks it daily, re-publishing it if it has gone missing, so the only thing you have to do is publish rua=.

What arrives

Aggregate reports are sent by receivers (Google, Microsoft, Yahoo and others) usually once a day. Each one names the reporter, the window, the policy they saw, and per sending IP: how many messages, and whether SPF and DKIM aligned. No message content is ever included.

The first report normally arrives within 24 to 48 hours of publishing the record.

Reading them

View	What it shows	Endpoint / tool
Summary	Report count, total messages, average pass rate over the last 30 days	`GET /api/dmarc/summary`, `get_dmarc_summary`
Senders	Every sending source: provider name where recognised, Known or Unknown, messages, passing, failing	`GET /api/dmarc/senders?days=30`, `get_dmarc_senders`
Reports	The raw list, newest first, per domain	`GET /api/dmarc/reports`, `list_dmarc_reports`
Upload	Paste or upload an XML report you received elsewhere	`POST /api/dmarc/reports`

"Unknown" senders with real volume are the thing to look at: either a service someone signed up for that is not in SPF, or someone forging you.

Rotating the address

POST /api/dmarc/rotate (the Rotate button, or the rotate_dmarc_inbox tool) issues a new address and retires the old one. Every domain's DMARC record then has to be updated, so the tool asks for confirmation, and a rotation is refused within 24 hours of the last one.

DMARC alerts

The alert cron runs every five minutes for accounts with DMARC reports (Starter and up) and reads the record state off the newest scan, never a second DNS lookup. Each alert lands in the Alerts feed and is pushed to the app:

Trigger	Alert	Cooldown
A new sender with at least 5 unauthenticated messages	One batched alert per account	Once per sender ever; at most one alert per account per 6 hours
The `_dmarc` record disappeared	One per domain	Once per transition; a reminder after 7 days
Policy downgraded (any drop in strength: `reject` to `quarantine` or `none`, `quarantine` to `none`, or unreadable)	One per domain	Once per transition; again at once if it falls further, and a reminder after 7 days if it stays weakened
Alignment drop: the share of mail passing DMARC over the last 7 days falls at least 20 points from a baseline of 90% or more, with at least 100 messages	One per domain	Once per episode; at most once every 7 days per domain
Record or policy restored	One per domain; the earlier alert clears	Once

Switch: DMARC alerts under Notification settings.

Common questions

No reports after a week. See No DMARC reports are arriving. The usual causes are rua= pointing elsewhere, a typo in the address, or the record being on a subdomain.

Do I need one address per domain? No. One address per account; the report names the domain it is about.