How to Interpret DMARC Aggregate Reports and Trace Attack Sources
DMARC aggregate reports provide a structured view of how receiving mail systems evaluate messages claiming to come from your domain. They show sending IP addresses, authentication results, message volumes, and the policy action applied to each group of emails.
When reviewed consistently, these reports can separate authorized services from misconfigured systems and likely spoofing attempts. The objective is not simply to find failed messages, but to understand which sources are sending mail, why authentication fails, and whether those sources represent a genuine security threat.
A careful reading of the XML data also helps reveal compromised accounts, forgotten vendors, shadow IT, and domain impersonation. The most useful analysis combines DMARC results with SPF, DKIM, domain alignment, message volume, and IP reputation.
Start With The Report Structure
A DMARC aggregate report is usually delivered as an XML attachment from participating mailbox providers. It may cover a 24-hour reporting period and contain several records, each grouping messages by source IP address and authentication outcome.
The report metadata identifies the reporting organization, the policy domain, and the time range. The policy section shows whether the domain requested monitoring, quarantine, or rejection, along with the alignment modes for SPF and DKIM. These settings define how strictly the receiver evaluates authentication.
Each record then provides a source IP, message count, disposition, and authentication results. A single report may contain many records, so sorting or importing the data into a dashboard makes recurring patterns easier to identify than reading raw XML manually.
Examine The Sending IP First
The source IP is the most direct clue when investigating an unfamiliar sender. Compare it with the IP ranges published by your email provider, marketing platforms, customer relationship systems, ticketing tools, and other approved services. A legitimate vendor may appear unfamiliar simply because its infrastructure is managed by a third party.
Reputation adds useful context but should not be treated as proof. An IP listed on blocklists or associated with suspicious behavior deserves closer attention, while a clean reputation does not guarantee that the sender is authorized. You can perform a separate sender IP reputation check to add threat intelligence to your DMARC investigation.
Look for repeated activity rather than reacting to one isolated record. A source sending two failed messages may be a test or a forwarding artifact; an unknown IP sending thousands of messages that fail both SPF and DKIM is far more consistent with abuse or domain spoofing.
Read Authentication And Alignment Together
DMARC passes when either SPF or DKIM passes and aligns with the visible From domain. This distinction matters because an email can pass SPF for a vendor’s envelope domain while still failing DMARC if that domain does not align with the address recipients see.
DKIM results show whether the cryptographic signature was valid, but a valid signature from an unrelated domain may not satisfy DMARC alignment. SPF results indicate whether the sending IP was authorized for the return-path domain, yet forwarding can break SPF even when the original message was legitimate.
Use the results in combination:
| Pattern | Likely Meaning | Investigation Focus |
|---|---|---|
| SPF pass and aligned, DKIM pass | Authorized and correctly configured sender | Confirm the service and document it |
| SPF fail, DKIM pass and aligned | Legitimate sender with SPF or forwarding issues | Review SPF records and mail routing |
| SPF pass, DKIM pass, but DMARC fail | Authentication domains do not align | Check vendor configuration and From-domain settings |
| SPF fail and DKIM fail | Possible spoofing, misconfiguration, or unauthorized sender | Validate the IP, volume, and provider identity |
| Authentication passes from an unknown IP | Possible forgotten service or compromised account | Identify the infrastructure before allowing it |
The DMARC guidance can help clarify policy modes, alignment, reporting, and record configuration while you interpret these combinations.
Use Volume And Timing To Prioritize Risk
Message count is one of the strongest signals in an aggregate report. High-volume failed traffic from a single unfamiliar network may indicate a campaign attempting to impersonate your domain. Low-volume failures can still matter when they recur from the same source or target sensitive recipients.
Compare activity across reporting periods. A sudden spike may correspond to a phishing campaign, a newly compromised system, or a legitimate business change. A source that appears at regular intervals may belong to an automated application that has not been added to your SPF or DKIM configuration.
The report timestamp also helps correlate activity with security logs, help-desk complaints, phishing reports, and outbound mail records. Matching a suspicious IP and time window against firewall, identity, or cloud email logs can distinguish external spoofing from an account or server operating inside your environment.
Separate Spoofing From Misconfiguration
A failed DMARC record does not automatically mean an attack. Common benign causes include an outdated SPF record, a vendor using the wrong DKIM selector, forwarding through another provider, mailing-list modifications, and a new SaaS platform that was never documented.
Attack indicators become stronger when several conditions appear together: the source is unknown, the volume is abnormal, both SPF and DKIM fail, the visible From domain imitates a trusted brand, and the IP has a poor reputation. Geographic inconsistency and repeated activity across multiple receivers can add further evidence.
If the source is clearly unauthorized, review whether your domain has weak or missing enforcement and investigate related abuse. Practical anti-spoofing measures include accurate SPF, DKIM signing, DMARC enforcement, protected registrar access, and monitoring for lookalike domains.
Build A Repeatable Investigation Process
DMARC analysis is most effective when every unfamiliar source follows the same review path. Record the IP, count, date range, SPF result, DKIM result, aligned domains, disposition, and likely owner. Then classify the record as approved, misconfigured, unknown, or malicious.
Prioritize sources with failed authentication and meaningful volume, but keep a watch list for low-volume anomalies. Contact vendors through verified channels before adding new infrastructure to your SPF record, and avoid broad allowlisting based only on a sender’s claim.
A lightweight workflow can include these steps:
Prioritize The Most Useful Checks
- Identify the source IP and hosting organization.
- Compare the IP with approved email vendors and internal systems.
- Verify SPF authorization and DKIM alignment separately.
- Correlate report timestamps with mail, identity, and security logs.
- Track repeated failures and escalate unexplained high-volume activity.
Over time, trends matter more than individual records. Once legitimate senders are documented and corrected, the remaining failed sources become easier to evaluate. Increasing DMARC enforcement gradually can then reduce the number of messages that reach recipients while preserving legitimate business mail.
Use aggregate reports as an early-warning system rather than a one-time configuration test. Review them on a schedule, investigate new infrastructure promptly, and connect the findings with sender reputation and domain monitoring. This turns DMARC data into a practical method for locating spoofing sources and strengthening trust in every message sent from your domain.