hmLoadTopic({
hmKeywords:"DMARC,DMARC aggregate reports,DMARC failure reports,DMARC records,DMARC Reporting,DMARC tags,fo tag,rf tag,ri tag,rua tag,ruf tag,Tags,Tags DMARC,Tags fo,Tags fr,Tags ri,Tags rua,Tags ruf",
hmTitle:"DMARC Reporting",
hmDescription:"When MDaemon queries DNS for a DMARC record, the record may contain various tags indicating that the domain owner wishes to receive DMARC reports regarding messages claiming to...",
hmPrevLink:"security--dmarc_verification.html",
hmNextLink:"security--dmarc_options.html",
hmParentLink:"security--dmarc.html",
hmBreadCrumbs:"<a href=\"security_menu.html\">Security Menu<\/a> &gt; Security Manager &gt; Sender Authentication &gt; <a href=\"security--dmarc.html\">DMARC<\/a>",
hmTitlePath:"Security Menu > Security Manager > Sender Authentication > DMARC > DMARC Reporting",
hmHeader:"<h1 class=\"p_Heading1\" style=\"page-break-after: avoid;\"><span class=\"f_Heading1\">DMARC Reporting<\/span><\/h1>\n\r",
hmBody:"<p class=\"p_BodyText_Center\"><img style=\"margin:0 auto 0 auto;width:32.5625rem;height:26.9375rem;border:none\" src=\".\/images\/sender-authentication_dmarc-reporting.png\"\/><\/p>\n\r<p class=\"p_BodyText\"><span class=\"f_BodyText\">When MDaemon queries DNS for a DMARC record, the record may contain various tags indicating that the domain owner wishes to receive DMARC reports regarding messages claiming to be from that domain. The options on the DMARC Reporting screen are for designating whether or not you wish to send DMARC aggregate or failure reports to the domains whose DMARC records request them, and for specifying the meta-data those reports will contain. The options on this screen are only available when the &quot;<\/span><span class=\"f_BodyText\" style=\"font-style: italic;\">Enable DMARC verification and reporting<\/span><span class=\"f_BodyText\">&quot; option is enabled on the <a href=\"security--dmarc_verification.html\" class=\"topiclink\">DMARC Verification<\/a> screen. Further, the DMARC specification requires the use of <a href=\"ssl_mdaemon.html\" class=\"topiclink\">STARTTLS<\/a> whenever it is offered by report receivers. You should therefore enable STARTTLS if possible.<\/span><\/p>\n\r<p class=\"p_DialogSectionHeading\" style=\"page-break-after: avoid;\"><span class=\"f_DialogSectionHeading\">DMARC Reporting<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Send DMARC aggregate reports<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">Enable this option if you are willing to send DMARC aggregate reports to domains who request them. When a DMARC DNS query on an incoming message\'s <\/span><span class=\"f_PlainText\">From:<\/span><span class=\"f_ControlIndent\"> domain indicates that its DMARC record contains the &quot;<\/span><span class=\"f_PlainText\">rua=<\/span><span class=\"f_ControlIndent\">&quot; tag (e.g. <\/span><span class=\"f_PlainText\">rua=mailto:dmarc-reports@example.com<\/span><span class=\"f_ControlIndent\">), then that means the domain owner wishes to receive DMARC aggregate reports. MDaemon will therefore store DMARC related information about the domain and about the incoming messages claiming to be from that domain. It will log the email addresses to which the aggregate report should be sent, the verification methods used for each message (SPF, DKIM, or both), whether or not the message passed or failed, the sending server, its IP address, the DMARC policy applied, and so on. Then, each day at Midnight UTC MDaemon will use the stored data to generate each domain\'s report and send it to the designated addresses. Once the reports are sent, the stored DMARC data is cleared and MDaemon will start the whole process again.<\/span><\/p>\n\r<div style=\"text-align: left; text-indent: 0; padding: 0 0 0 0; margin: 0 3.0625rem 0.8750rem 3.0000rem;\"><table style=\"background-color:#ffffe6; border:solid thin #000000; border-spacing:0;\">\n\r<tr>\n\r<td style=\"vertical-align:top; width:3.1250rem; height:3.1250rem; padding:0.3125rem; border:none\"><p class=\"p_NoFormat\"><img style=\"margin:0;width:3.1250rem;height:3.1250rem;border:none\" src=\".\/images\/lightbulb_on_50_yback.gif\"\/><\/p>\n\r<\/td>\n\r<td style=\"vertical-align:top; padding:0.3125rem; border:none\"><p class=\"p_Notes\"><span class=\"f_Notes\">MDaemon does not support the DMARC report interval tag (i.e. &quot;<\/span><span class=\"f_PlainText\">ri=<\/span><span class=\"f_Notes\">&quot;) for aggregate reporting. MDaemon will send aggregate reports each day at Midnight UTC, to any domain for which it has compiled DMARC data since the last time the DMARC reports were generated and sent.<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<\/table>\n\r<\/div>\n\r<p class=\"p_ControlHeading2\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading2\">Send aggregate reports now<\/span><\/p>\n\r<p class=\"p_ControlIndent2\"><span class=\"f_ControlIndent2\">Click this button if you wish to generate and send a batch of aggregate reports from the currently stored DMARC data, instead of waiting until MDaemon does so automatically at the next Midnight UTC batch event. This sends the reports immediately and clears the stored DMARC data, exactly like what happens each day at Midnight UTC. MDaemon will then begin storing DMARC data again until the next Midnight UTC event, or until you click the button again, whichever come first.<\/span><\/p>\n\r<div style=\"text-align: left; text-indent: 0; padding: 0 0 0 0; margin: 0 3.0625rem 0.8750rem 3.0000rem;\"><table style=\"background-color:#ffffe6; border:solid thin #000000; border-spacing:0;\">\n\r<tr>\n\r<td style=\"vertical-align:top; width:3.1250rem; height:3.1250rem; padding:0.3125rem; border:none\"><p class=\"p_NoFormat\"><img style=\"margin:0;width:3.1250rem;height:3.1250rem;border:none\" src=\".\/images\/forbidden_50_yback.gif\"\/><\/p>\n\r<\/td>\n\r<td style=\"vertical-align:top; padding:0.3125rem; border:none\"><p class=\"p_Notes\"><span class=\"f_Notes\">Because MDaemon must be running at Midnight UTC to send aggregate reports and clear stored DMARC data automatically, if you have MDaemon shut down at that time then no reports will be generated and the DMARC data will not be cleared. DMARC data collection will continue whenever MDaemon is running again, but reports will not be generated and data will not be cleared until the next Midnight UTC event, or until you click the &quot;<\/span><span class=\"f_Notes\" style=\"font-style: italic;\">Send aggregate reports now<\/span><span class=\"f_Notes\">&quot; button.<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<\/table>\n\r<\/div>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Send DMARC failure reports (reports are sent as incidents occur)<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">Enable this option if you are willing to send DMARC failure reports to domains who request them. When a DMARC DNS query on an incoming message\'s <\/span><span class=\"f_PlainText\">From:<\/span><span class=\"f_ControlIndent\"> domain indicates that its DMARC record contains the &quot;<\/span><span class=\"f_PlainText\">ruf=<\/span><span class=\"f_ControlIndent\">&quot; tag (e.g. <\/span><span class=\"f_PlainText\">ruf=mailto:dmarc-failure@example.com<\/span><span class=\"f_ControlIndent\">), then that means the domain wishes to receive DMARC failure reports. Unlike aggregate reports, these reports are created in real-time as the incidents which trigger them occur, and they contain extensive detail regarding each incident and the errors that caused the failure. These reports can be used for forensic analysis by the domain\'s administrators to correct problems with their email system configuration or identify other problems, such as ongoing phishing attacks.<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">The type of failure that will trigger a failure report is dependent upon the value of the &quot;<\/span><span class=\"f_PlainText\">fo=<\/span><span class=\"f_ControlIndent\">&quot; tag in the domain\'s DMARC record. By default a failure report will only be generated if all of the underlying DMARC checks fail (i.e. both SPF and DKIM fail), but domains can use various &quot;<\/span><span class=\"f_PlainText\">fo=<\/span><span class=\"f_ControlIndent\">&quot; tag values to indicate that they wish to receive the reports only if SPF fails, only if DKIM fails, if either fail, or some other combination. Consequently, multiple failure reports can be generated from a single message depending upon the number of recipients in the DMARC record\'s &quot;<\/span><span class=\"f_PlainText\">ruf=<\/span><span class=\"f_ControlIndent\">&quot; tag, the value of the &quot;<\/span><span class=\"f_PlainText\">fo=<\/span><span class=\"f_ControlIndent\">&quot; tag, and number of independent authentication failures that are encountered for the message during processing. If you wish to limit the number of recipients to which MDaemon will send any given report, use the &quot;<\/span><span class=\"f_ControlIndent\" style=\"font-style: italic;\">Honor up to this many DMARC \'rua\' and \'ruf\' recipients<\/span><span class=\"f_ControlIndent\">&quot; option below.<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">For the report format, MDaemon will only honor the <\/span><span class=\"f_PlainText\">rf=afrf<\/span><span class=\"f_ControlIndent\"> tag (<a href=\"https:\/\/datatracker.ietf.org\/doc\/rfc6591\/\" target=\"_blank\" class=\"weblink\" title=\"RFC-6591\">Authentication Failure Reporting Using the Abuse Reporting Format<\/a>), which is the DMARC default. All reports are sent in this format, even if a domain\'s DMARC record contains the <\/span><span class=\"f_PlainText\">rf=iodef<\/span><span class=\"f_ControlIndent\"> tag.<\/span><\/p>\n\r<div style=\"text-align: left; text-indent: 0; padding: 0 0 0 0; margin: 0 3.0625rem 0.8750rem 3.0000rem;\"><table style=\"background-color:#ffffe6; border:solid thin #000000; border-spacing:0;\">\n\r<tr>\n\r<td style=\"vertical-align:top; width:3.1250rem; height:3.1250rem; padding:0.3125rem; border:none\"><p class=\"p_NoFormat\"><img style=\"margin:0;width:3.1250rem;height:3.1250rem;border:none\" src=\".\/images\/lightbulb_on_50_yback.gif\"\/><\/p>\n\r<\/td>\n\r<td style=\"vertical-align:top; padding:0.3125rem; border:none\"><p class=\"p_Notes\"><span class=\"f_Notes\">In order to support DMARC failure reporting, MDaemon fully supports: <a href=\"https:\/\/datatracker.ietf.org\/doc\/rfc5965\/\" target=\"_blank\" class=\"weblink\" title=\"RFC-5965\">RFC 5965: An Extensible Format for Email Feedback Reports<\/a>, <a href=\"https:\/\/datatracker.ietf.org\/doc\/rfc6591\/\" target=\"_blank\" class=\"weblink\" title=\"RFC-6591\">RFC 6591: Authentication Failure Reporting Using the Abuse Reporting Format<\/a>, <a href=\"https:\/\/datatracker.ietf.org\/doc\/rfc6652\/\" target=\"_blank\" class=\"weblink\" title=\"RFC-6652\">RFC 6652: Sender Policy Framework (SPF) Authentication Failure Reporting Using the Abuse Reporting Format<\/a>, <a href=\"https:\/\/datatracker.ietf.org\/doc\/rfc6651\/\" target=\"_blank\" class=\"weblink\" title=\"RFC-6651\">RFC 6651: Extensions to DomainKeys Identified Mail (DKIM) for Failure Reporting<\/a>, and <a href=\"https:\/\/datatracker.ietf.org\/doc\/rfc6692\/\" target=\"_blank\" class=\"weblink\" title=\"RFC-6692\">RFC 6692: Source Ports in Abuse Reporting Format (ARF) Reports<\/a>.<\/span><\/p>\n\r<p class=\"p_Notes\"><span class=\"f_Notes\">When the DMARC &quot;<\/span><span class=\"f_PlainText\">fo=<\/span><span class=\"f_Notes\">&quot; tag requests reporting of SPF related failures, MDaemon sends SPF failure reports according to RFC 6522. Therefore, that specification\'s extensions must be present in the domain\'s SPF record. SPF failure reports are not sent independent of DMARC processing or in the absence of RFC 6522 extensions.<\/span><\/p>\n\r<p class=\"p_Notes\"><span class=\"f_Notes\">When the DMARC &quot;<\/span><span class=\"f_PlainText\">fo=<\/span><span class=\"f_Notes\">&quot; tag requests reporting of DKIM related failures, MDaemon sends DKIM<\/span><span class=\"f_Notes\"> failure reports according to RFC 6651. Therefore, that specification\'s extensions must be present in the DKIM-Signature header field, and the domain must publish a valid DKIM reporting TXT record in DNS.<\/span><span class=\"f_Notes\"> DKIM<\/span><span class=\"f_Notes\"> failure reports are not sent independent of DMARC processing or in the absence of RFC 6651 extensions.<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<\/table>\n\r<\/div>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Honor up to this many DMARC \'rua\' and \'ruf\' recipients (0 = no limit)<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">If you wish to limit the number of recipients to which MDaemon will send any given DMARC aggregate report or DMARC failure report, specify the maximum number here. If a DMARC record\'s &quot;<\/span><span class=\"f_PlainText\">rua=<\/span><span class=\"f_ControlIndent\">&quot; or &quot;<\/span><span class=\"f_PlainText\">ruf=<\/span><span class=\"f_ControlIndent\">&quot; tag contains more addresses than your designated limit, then MDaemon will send a given report to the listed addresses, in order, until the maximum number of addresses is reached. By default there is no limit set.<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Email a copy of all reports to:<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">Enter one or more comma-separated email addresses here to send them a copy of all DMARC aggregate and DMARC failure reports (fo=0 or fo=1 only).<\/span><\/p>\n\r<p class=\"p_DialogSectionHeading\" style=\"page-break-after: avoid;\"><span class=\"f_DialogSectionHeading\">DMARC Report Meta-Data<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">Use these options to specify your company or organization\'s meta-data, which will be included with the DMARC reports you send.<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Organization name<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">This is the entity responsible for producing the DMARC reports. It must be one of your MDaemon domains. Choose the domain from the drop-down list.<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Contact email<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">Use this option to specify local email addresses that report receivers can contact about problems with the report. Separate multiple addresses with a comma.<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Contact information<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">Use this option to include any additional contact information for report receivers, such as a website, a phone number, or the like.<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Report return-path<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">This is the SMTP return path (bounce address) used for report messages that MDaemon sends, in case there are delivery problems. Use <\/span><span class=\"f_PlainText\">noreply@&lt;mydomain.com&gt;<\/span><span class=\"f_ControlIndent\"> to ignore such problems.<\/span><\/p>\n\r<p class=\"p_SeeAlso\" style=\"page-break-after: avoid; border-right: none; border-bottom: none; border-left: none;\"><span class=\"f_SeeAlso\">See:<\/span><\/p>\n\r<p class=\"p_SeeAlsoLinks\" style=\"page-break-after: avoid;\"><span class=\"f_SeeAlsoLinks\"><a href=\"security--dmarc.html\" class=\"topiclink\">DMARC<\/a><\/span><\/p>\n\r<p class=\"p_SeeAlsoLinks\" style=\"page-break-after: avoid;\"><span class=\"f_SeeAlsoLinks\"><a href=\"security--dmarc_verification.html\" class=\"topiclink\">DMARC Verification<\/a><\/span><\/p>\n\r<p class=\"p_SeeAlsoLinks\" style=\"page-break-after: avoid;\"><span class=\"f_SeeAlsoLinks\"><a href=\"security--dmarc_options.html\" class=\"topiclink\">DMARC Settings<\/a><\/span><\/p>\n\r"
})
