DMARC monitoring

DMARC monitoring gives you continuous visibility into who is sending email using your domain and whether that mail is passing authentication. InboxEagle parses your DMARC aggregate reports automatically and surfaces unauthorized senders, alignment failures, and policy enforcement data in real time.

Note

This page covers ongoing DMARC monitoring — reviewing aggregate report data and responding to findings. For setting up your DMARC DNS record for the first time, see Authenticate your sending domain.

What DMARC monitoring shows

InboxEagle parses DMARC aggregate reports (rua data) sent by mailbox providers and surfaces:

• Unauthorized senders — Third parties sending mail that claims your From domain but is not authorized by your SPF record or DKIM signature
• Alignment failures — Sources where SPF or DKIM passes individually but the domain alignment check fails
• Volume by source — How much mail is being sent from each IP or domain on your behalf
• Policy enforcement — What percentage of your mail is covered by your current DMARC policy (p=none, p=quarantine, or p=reject)

InboxEagle achieves 99.8% enforcement visibility — meaning nearly all mail claiming your domain is reflected in your aggregate report data.

How DMARC aggregate reports work

Mailbox providers (Gmail, Yahoo, Outlook, and others) send DMARC aggregate reports to the rua email address in your DMARC record once per day, typically within 24 hours of the reporting period. The reports are XML files listing every source IP that sent mail claiming your domain, along with authentication results.

InboxEagle receives and parses these reports on your behalf. You do not need to manage the XML data yourself.

Note

The inherent delay in aggregate reports is 24 hours — this is set by the DMARC standard and cannot be shortened. InboxEagle fires alerts within 2 minutes of receiving and processing new report data, but the reports themselves arrive once per day from each provider.

Unauthorized senders

The unauthorized senders panel lists every IP or sending source that claims your domain in the From: address but is not authorized by your SPF record or signed with your DKIM key.

For each unauthorized sender, evaluate:

Type	What it is	What to do
Legitimate source you forgot	A marketing tool, CRM, or transactional service you use but did not add to SPF	Add the sending source to your SPF record or DKIM configuration
Spoofing attempt	An IP with no relation to your organization	No action on your SPF/DKIM needed; your DMARC policy (p=quarantine or p=reject) will handle these
Compromised account	A legitimate IP that has been sending spam or phishing in your name	Contact the service provider; also review whether your own account credentials need rotating

Alignment failures

DMARC requires that either SPF or DKIM alignment passes — not just that SPF or DKIM passes individually. Alignment means the domain in the authentication result must match the domain in the From: header.

Failure type	What it means	Typical fix
SPF pass / DKIM fail / DMARC fail	The IP is in your SPF record, but the DKIM signing domain does not match your From domain	Configure DKIM signing for this source using your From domain
DKIM pass / SPF fail / DMARC fail	The DKIM signature is valid, but the IP is not in your SPF record	Add the sending IP or include to your SPF record
Both SPF and DKIM fail / DMARC fail	Completely unauthenticated mail claiming your domain	Identify the source (legitimate or unauthorized) and act accordingly

Policy progression

DMARC policy controls what mailbox providers do with mail that fails DMARC:

Policy	What providers do with failing mail
p=none	Deliver as normal; reports are sent but no enforcement occurs
p=quarantine	Send failing mail to spam/junk folder
p=reject	Reject failing mail outright; it does not reach the recipient

Caution

Do not advance to p=reject until you have confirmed that:

1. The unauthorized sender list is empty (or all sources are identified and either added to SPF/DKIM or confirmed as spoofing that will be rejected)
2. Alignment failure rates are below 2% of total mail volume
3. You have been at p=quarantine for at least 2–4 weeks with no legitimate mail being quarantined

Advancing to p=reject prematurely will cause delivery failures for any legitimate sending source that is not yet properly authenticated.

InboxEagle shows your current policy on the DMARC monitoring dashboard and tracks changes over time, so you can see the impact of each policy advancement.

Alerts

InboxEagle alerts you when:

• A new unauthorized sender appears in your aggregate reports
• Alignment failure volume increases significantly
• Your DMARC policy changes (useful for detecting unauthorized DNS changes)

Alerts fire within 2 minutes of InboxEagle processing new aggregate report data.

To configure notification channels, go to Account → Notification settings.

Next steps

• Authenticate your sending domain — Set up or update your SPF, DKIM, and DMARC DNS records
• Sending domains — Domain-level authentication status and alignment rates
• Google Postmaster integration — Gmail-specific domain reputation and spam rate signals

View DMARC monitoring →