Overview
EuroMail ingests DMARC aggregate reports sent by receiving mail servers (Google, Yahoo, Microsoft, etc.), parses the XML, and presents the results in your dashboard. You can track alignment rates per domain, spot failing source IPs, and monitor trends over time -- all without leaving EuroMail.
How It Works
- You publish a DMARC DNS record with a
ruatag pointing to EuroMail's reporting address. - Receiving mail servers send aggregate reports as compressed XML attachments to that address (typically once per day).
- EuroMail's inbound SMTP server detects DMARC report emails by their subject line and attachment type.
- A worker decompresses and parses the XML (RFC 7489 Appendix C schema). Gzip, zip, and plain XML attachments are supported. Decompressed size is capped at 10 MB for security.
- Reports are stored in the database and linked to your account via domain ownership. Duplicate reports (same reporter + report ID) are skipped.
- The dashboard displays alignment rates, per-domain breakdowns, trends, and failing sources.
Setup
Add or update your DMARC DNS record to include EuroMail's reporting address in the rua tag:
_dmarc.yourdomain.com. TXT "v=DMARC1; p=reject; rua=mailto:[email protected]"If you already have a rua tag with another address, append EuroMail's address with a comma:
_dmarc.yourdomain.com. TXT "v=DMARC1; p=reject; rua=mailto:[email protected],mailto:[email protected]"EuroMail will automatically detect the rua tag during domain verification and suggest the correct record if it is missing.
Recommended Rollout
If you are setting up DMARC for the first time, start with a monitoring-only policy and tighten it once your alignment rate is stable:
| Phase | Policy | Purpose |
|---|---|---|
| Monitor | p=none | Collect reports without affecting delivery |
| Quarantine | p=quarantine | Send failures to spam |
| Reject | p=reject | Block delivery of unauthenticated emails |
Dashboard
The DMARC monitoring dashboard is available at DMARC Monitoring in the sidebar. Use the period selector to view data for the last 7, 30 (default), or 90 days.
Alignment Rate Card
The top-level card shows your overall alignment rate as a percentage, color-coded by threshold:
| Rate | Color | Meaning |
|---|---|---|
| 95% or higher | Green | Healthy alignment |
| 80% -- 94% | Amber | Some sources are failing |
| Below 80% | Red | Significant authentication issues |
A message passes DMARC when at least one aligned mechanism passes -- aligned SPF or aligned DKIM (RFC 7489 §4.2). Both do not have to pass. DKIM-only alignment is normal and healthy: the bounce domain in the envelope rarely matches your From domain, so SPF often aligns for neither.
Summary Stats
Four cards show totals for the selected period:
- Total Reports -- Number of aggregate reports received
- Messages Analyzed -- Total message count across all reports
- Passed -- Messages where at least one aligned mechanism passed
- Failed -- Messages where SPF or DKIM (or both) failed
Per-Domain Alignment Table
A breakdown of alignment by domain, showing:
| Column | Description |
|---|---|
| Domain | The sending domain from the report |
| Messages | Total messages analyzed |
| SPF Pass % | Percentage of messages that passed SPF |
| DKIM Pass % | Percentage of messages that passed DKIM |
| Alignment % | Percentage of messages that passed DMARC (aligned SPF or aligned DKIM) |
Percentages are color-coded using the same green/amber/red thresholds. Sorted by message count descending.
Alignment Trend Chart
A dual-axis line chart showing daily data points:
- Left axis: Alignment percentage (0-100%), orange line with fill
- Right axis: Message count, gray dashed line
Use this to identify drops in alignment that correlate with changes in sending volume or infrastructure.
Top Failing Sources
A table of the top 20 source IPs that sent messages failing SPF or DKIM:
| Column | Description |
|---|---|
| Source IP | The sending server's IP address |
| Header From | The From domain in the message header |
| Total | Total messages from this source |
| Failed | Messages that failed alignment |
| Last Seen | Most recent report containing this source |
Sorted by failure count descending. A source appears only when both aligned mechanisms failed; passing on one alone is a DMARC pass and is not listed. If every source passes, this table is empty.
DMARC Reports List
The DMARC Reports page lists all received aggregate reports with:
- Reporter organization (Google, Yahoo, Microsoft, etc.)
- Domain
- Report period (date range)
- Policy badge (reject = green, quarantine = amber, none = gray)
- Pass/fail counts
Click a report to view its full details, including the published policy, alignment modes (relaxed vs strict), and individual source records with per-record SPF and DKIM results.
Interpreting Results
SPF vs DKIM vs Full Alignment
- SPF alignment -- The envelope sender domain matches the
Fromheader domain (or its subdomain, in relaxed mode). SPF alone can break when emails are forwarded. - DKIM alignment -- The DKIM signing domain matches the
Fromheader domain. DKIM survives forwarding because the signature travels with the message. - DMARC pass -- At least one aligned mechanism passes (RFC 7489 §4.2). This is what EuroMail measures for the alignment rate.
Common Failure Causes
| Symptom | Likely Cause |
|---|---|
| SPF failing from unknown IPs | A third-party service is sending on your domain without being included in your SPF record |
| DKIM failing | DKIM key rotation without updating DNS, or a forwarding server modifying the message body |
| Low alignment from a specific IP | A misconfigured server or an unauthorized sender |
| Alignment drops after DNS change | SPF or DKIM records were accidentally modified or removed |
Period Selection
All dashboard views support three time windows:
| Period | Description |
|---|---|
| 7 days | Recent activity, useful for spotting sudden changes |
| 30 days | Default view, balances recency with statistical significance |
| 90 days | Long-term trends and seasonal patterns |