DMARC and TLS-RPT reports
With rua=mailto:… in the DMARC record, receivers such as Google, Microsoft and Yahoo send you daily aggregate reports: which servers sent on behalf of the domain, how many messages, whether DKIM and SPF passed and what the receiver did with the messages. Without these reports, moving to p=quarantine or p=reject is flying blind – with them you see which legitimate senders (newsletter service, CRM, shop) do not sign properly yet.
DomainWarn provides a report address per domain (domain → Email → “DMARC and TLS-RPT reports”). Add it as rua and ruf to the DMARC record; the first reports arrive within a day. The card shows messages, alignment rate, the reported policy, unaligned messages per day and every source with DKIM, SPF and alignment result plus disposition. TLS-RPT reports (_smtp._tls record with the same address) show whether senders reach your mail servers over TLS and why sessions fail.
Reports can also be uploaded by hand (XML, GZ, ZIP, JSON or the whole email), for example from an existing mailbox.
The DMARC assistant on the DMARC subpage uses these reports for the way from p=none via quarantine to reject (a prerequisite for BIMI, for example). It classifies every source, takes forgeries without any authentication out of the legitimate mail and only recommends the next step once there is enough data (14 days with reports before the first step, 7 days since every further change, at least 100 messages), at least 98 % of the legitimate mail passes DMARC and no legitimate-looking sender (such as a newsletter service that only signs with its own domain) fails noticeably. If the record uses pct, it goes in stages of 25, 50 and 100 %; a weaker sp moves along. The proposed record only changes p, pct and sp, everything else stays. With a connected DNS provider the team applies it with one click after a preview and a confirmation (write permission required); DomainWarn changes exactly the one existing DMARC record and stops if it has changed since the preview. If the report address is missing from rua, the assistant adds it as an additional target on request.
v=DMARC1; p=quarantine; rua=mailto:<TOKEN>@dmarc.domainwarn.com; ruf=mailto:<TOKEN>@dmarc.domainwarn.com