RFC 9991 / START HERE
DMARC failure reports, before the details
DMARC failure reporting
DMARC is Domain-based Message Authentication, Reporting, and Conformance. Failure reporting provides information about individual authentication failures when reports are requested and supported.
The idea in one picture
An individual message fails checks
A receiver may prepare a report
The domain owner investigates
A simplified picture of the idea; the chapters explain the actual mechanisms.
Why it exists
Some failures need more detail than a statistical summary provides. Individual reports also raise privacy and disclosure considerations.
A familiar example
A participating receiver may report details of an authentication failure to help a domain owner investigate a mail problem.
Helpful background
You can start here without reading another RFC. If these ideas are unfamiliar, these short introductions may help.
What you’ll learn next
Begin with chapter one, or choose a topic.
- An individual failure reportA failure report concerns an individual message, unlike an aggregate traffic summary.→
- Structured ARF fieldsThe augmented failure-report format includes alignment and authentication-specific fields.→
- External failure recipientsExternal ruf destinations use the aggregate specification’s destination-verification procedure with the failure-report tag.→
- Minimize sensitive evidenceFailure feedback can contain private message content and therefore creates greater exposure than aggregate counts.→
- Abuse and recipient controlsFailure reporting can be abused as an amplification or disclosure path.→
This introduction explains RFC 9991 (2026). Read the original RFC ↗