Technical guide

How to analyze DMARC RUA reports without losing legitimate senders

RUA reports map who sends as your domain and what stronger policy would affect. They are not an automatic attacker list.

LuminaKite Security TeamPublished: 2026-07-216 min read

The problem

Each receiver aggregates by source, domain, and authentication. With many SaaS senders, forwarders, and mail systems, manually combining XML hides trends and may block legitimate traffic.

Risks and assumptions

Misclassifying a legitimate but misaligned source as malicious.

Moving to `reject` before observing business cycles.

Retaining XML and attachments longer than necessary even though they contain third-party IPs and domains.

Procedure

Validate the DMARC record

Check syntax, organizational domain, policy, percentage, and authorized RUA destinations.

Group by source and volume

Look for sustained patterns rather than treating one row as the full picture.

Review SPF and DKIM alignment

A pass is insufficient when its authenticated domain does not align with visible From.

Classify with owners

Relate IPs and domains to providers, campaigns, and teams before correction.

Tighten gradually

Increase policy and percentage only after legitimate senders are fixed and rollback is defined.

Limits of a manual approach

Not every receiver sends RUA or follows the same cadence.

Aggregates contain no message bodies and do not prove intent.

Forwarding and mailing lists require additional context.

Example

A marketing provider may pass DKIM for its own domain but fail DMARC alignment. Configure aligned signing or a custom domain instead of allowlisting every observed IP.

Common mistakes

Treating each IP as a separate provider.

Reading SPF pass without checking alignment.

Moving to `p=reject` on publication day.

Recommendations

Maintain a sender catalog with owner and justification.

Compare equivalent periods for volume changes.

Minimize and bound aggregate-data retention.

Frequently asked questions

Does RUA contain email content?

No. It contains authentication aggregates, though source IPs and domains may be present.

What does disposition=none mean?

The receiver did not quarantine or reject that group under DMARC; read it with policy and authentication outcomes.

How long should p=none observation last?

Until relevant business cycles are covered and legitimate sources are classified; there is no universal period.

Analyze RUA continuously

Centralize source trends and classification before changing enforcement.

Explore the module