Forensic Report Viewer
View and analyze DMARC forensic reports in a human-readable format.
DMARC Summary Dashboard
Frequently Asked Questions
Common questions about DMARC forensic reports
What are DMARC forensic reports?
DMARC forensic reports (RUF) are individual email samples sent when authentication fails. Unlike aggregate reports, they contain actual message headers and help identify spoofing or misconfigurations in real-time.
What is the difference between RUA and RUF reports?
RUA provides daily summaries (essential for monitoring). RUF sends individual failure samples with message details (optional, contains sensitive data). Most use only RUA due to privacy concerns.
Should I enable DMARC forensic reporting?
Forensic reporting (ruf=) is optional with privacy implications. Enable only if you need detailed failure analysis and have proper data handling. Aggregate reports (rua=) are sufficient for most organizations.
Help & Resources
What is a Forensic DMARC Report?
Forensic (ruf) DMARC reports are detailed notifications sent when an email fails DMARC authentication. They help you investigate suspicious or failed messages.
How to Use This Tool
- Upload one or more .xml forensic DMARC report files.
- Review the parsed incidents in the table below.
- Search, filter, and export results as needed.
Forensic reports may contain sensitive message data. Handle and store them securely.
Learn More
Need more help? Check out our documentation or contact support.