4

I have a client that's receiving DMARC reports from various providers however the reports indicate that all checks 'PASS' and all DMARC/DKIM/SPF checking tools indicate the DMARC records are fine. The reports are in XML format and zipped up. Is there any easy way to tell the difference between rua and ruf reports? Are ruf reports delivered in a zip file like rua reports? My client believes that since he is receiving reports not at the exact same time everyday that they can't be rua reports however I'm not so sure.

Any help would be appreciated :)

8

Providers send aggregate reports at varying times. Many come at midnight UTC, but some providers like Microsoft often send hourly reports. Forensic reports come in neartime, usually about 5-10 minutes after the failing message hit the ISP's front end inbound mailers.

You can tell RUA from RUF reports apart pretty easily. An aggregate, or RUA report typically starts like:

--report_section
Content-Type: text/plain;

This is a DMARC aggregate report for yourdomain.com
generated at Mon Mar 23 03:53:50 UTC 2015

while a forensic or RUF report generall starts like:

--61204608-60BE-4D26-9E07-F450C5B0D826
Content-Type: text/plain; charset="US-ASCII"
Content-Transfer-Encoding: 7bit

This is an email abuse report for an email message received from IP 10.10.10.10 on Mon Mar 23 04:01:02 UTC 2015.
The message below did not meet the sending domain's authentication policy.
For more information about this format please see http://www.ietf.org/rfc/rfc5965.txt.

--61204608-60BE-4D26-9E07-F450C5B0D826
Content-Type: message/feedback-report

You will also notice that an RUA report has (often gzipped) XML as an attachment, while the attachment for a RUF report is actual MIME. Few people try to manually read or verify either type of report. Services like Agari and Dmarcian are specifically built to interpret DMARC reporting.

  • Thanks for the info, I think this is the info I was looking for :) – user315851 Oct 21 '15 at 13:49
  • No problem! Glad I could help. – cmeid Oct 23 '15 at 16:47
  • hey, you talk about microsoft sending hourly dmarc reports, is that still valid? please see: serverfault.com/questions/888126/… – agbb Dec 30 '17 at 1:43
  • Unfortunately I've been out of the DMARC business (used to be my day job) since mid 2016. I would suggest checking the list archives for the DMARC lists at IETF and dmarc.org. – cmeid Dec 30 '17 at 10:09
1

To provide more information on @cmeid great answer, if possible one can also provide different email address to the two report types on the DMARC DNS record (TXT) :

_dmarc.example.com TXT "v=DMARC1; p=none; pct=100; rua=mailto:dmarc@example.com; ruf=mailto:dmarc-forensic@example.com

This can help greatly in filtering those two from each others.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.