How to Automatically Filter or Delete DMARC Aggregate Report Emails

Quick Answer

DMARC aggregate report emails are automated security reports sent by email providers and receiving mail systems to the reporting address configured in your domain's DMARC DNS record. They normally contain XML data showing how messages claiming to come from your domain performed SPF, DKIM, and DMARC authentication checks.

If these emails are cluttering your inbox, you can create a Gmail filter or an Outlook rule to move them into a dedicated folder, apply a label, archive them, or delete them automatically. For most businesses, moving them to a separate folder is preferable to immediate deletion because the reports can help detect email spoofing, identify legitimate email services with authentication problems, and verify that the domain's DMARC policy is working correctly.

What Are DMARC Aggregate Report Emails?

DMARC stands for Domain-based Message Authentication, Reporting, and Conformance. It is an email authentication standard that helps domain owners reduce unauthorized use of their domains in email.

A DMARC aggregate report is a summary of email authentication results collected by a receiving mail system over a reporting period. Reports are commonly sent daily, although the reporting frequency depends on the provider and its implementation.

These messages often have subjects similar to:

• Report domain: example.com
• Report Domain: yourcompany.com Submitter: Google
• DMARC Aggregate Report for yourcompany.com

The exact subject, sender address, attachment name, and format vary by reporting organization.

The email usually includes an XML attachment, sometimes compressed as a GZIP file. The attachment is intended primarily for software tools that parse DMARC data, not for ordinary users to read as a normal email message.

Why Do These Emails Arrive in the Inbox?

Your domain's DMARC DNS record may contain a rua tag that specifies where receiving mail systems should send aggregate reports. If that tag contains your email address, the address may receive reports from multiple email providers and receiving systems.

For example, a DMARC DNS record might look like this:

v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com

This is an illustrative example. Replace example.com with your own domain when examining your actual configuration.

In this example:

• v=DMARC1: Identifies the DMARC record version.
• p=none: Requests monitoring without asking receivers to quarantine or reject messages based on the DMARC policy. Other email security controls may still apply.
• rua=mailto:dmarc-reports@example.com: Specifies the email address intended to receive aggregate reports.

When Gmail, Microsoft, Yahoo, or another participating receiving system processes email associated with your domain, it may generate an aggregate report and send it to the configured reporting address.

Important: The rua setting does not itself send these reports. It advertises the reporting destination to receiving systems that support DMARC reporting.

Which Domains or Companies Send DMARC Aggregate Reports?

DMARC reports can originate from many independent email providers, mailbox services, hosting companies, security gateways, and other receiving mail systems. The organizations sending reports are not necessarily the companies hosting your own mailbox.

Reporting organization or service	Why you might receive a report
Google and Gmail	A participating Google mail system processed messages relevant to your domain and generated authentication reporting data.
Microsoft and Outlook	A participating Microsoft mail system processed messages associated with your domain.
Yahoo Mail	A Yahoo receiving system generated a report for messages within its reporting scope.
Other email providers	Independent providers or receiving systems may send reports when they support DMARC aggregate reporting.
Email security gateways and hosting providers	A participating gateway or hosted mail service may generate reports based on the messages it processes.

This is a list of examples, not a guarantee that every organization sends reports to every domain owner. The exact sender addresses and participating providers can change.

To identify the organization that generated a particular report, check the sender address, email headers, subject, and the report's metadata. The XML commonly contains fields such as org_name, email, and report_id. The report filename may also include the reporting organization's domain.

Do not trust an email merely because its sender display name mentions Google, Microsoft, or another familiar provider. Unexpected attachments should be handled cautiously, and report authenticity should be evaluated using the message headers and other available evidence.

Why Can You Receive Reports from So Many Different Senders?

Your domain may send email to customers who use Gmail, Microsoft 365, Yahoo, and many other services. Each participating receiving system can independently produce a report covering the messages it handled.

For example, a company might send email through its website, business mailbox, accounting software, customer relationship management platform, and bulk email service. Recipients of those messages may use several different email providers.

The receiving providers can send separate reports about messages claiming to come from the company's domain. Consequently, the domain owner may receive multiple reports during the same day.

Reports can also arrive even when the business sends relatively little email. Receiving systems may process messages from third parties that impersonate the domain, or they may process legitimate messages sent through services that have not been correctly configured.

Are DMARC Aggregate Reports Important?

Yes, they can be important for email security and domain administration. Their value is in the information they provide, not in reading every report manually.

1. Detect unauthorized use of your domain

Reports can show messages that claim to come from your domain but fail DMARC authentication. Unexpected sending IP addresses or unfamiliar sending infrastructure may indicate spoofing or an unrecognized mail service. However, a failed result alone does not prove malicious activity.

2. Identify legitimate services with authentication problems

If your website, accounting software, support platform, or marketing service sends email using your domain, the reports can help identify SPF, DKIM, or alignment problems that may affect delivery.

3. Check whether SPF and DKIM are working together

SPF checks whether a sending server is authorized for the relevant envelope sender domain. DKIM checks a cryptographic signature associated with a message. DMARC evaluates whether at least one of these mechanisms passes and aligns with the domain in the visible From address.

4. Support a safer DMARC policy

Aggregate reports help administrators understand legitimate email flows before moving from monitoring to a policy that asks receiving systems to quarantine or reject messages that fail DMARC.

5. Provide visibility into email delivery and spoofing patterns

Reports can reveal recurring authentication failures, unexpected sending sources, and changes in email traffic. They provide useful evidence, although they do not guarantee that every spoofed message or abuse attempt will be detected.

Do You Need to Read DMARC Reports Every Day?

No. Most ordinary users and small-business owners do not need to open and manually inspect every XML report each day.

However, somebody responsible for the domain's email security should ensure that the reporting data is monitored appropriately. This can be done through a DMARC analysis service, a security monitoring workflow, or periodic review by an IT administrator.

Situation	Recommended approach
Personal or small-business mailbox with no dedicated IT team	Move reports to a separate folder and review periodically, especially after changing email services.
Business using multiple email-sending services	Keep reports and use a DMARC analysis tool or IT support process to identify authentication failures.
Domain undergoing DMARC setup or migration	Monitor reports more closely until all legitimate sending sources are identified and authentication is working as intended.
Established domain with a monitored DMARC service	Filter raw reports into a dedicated folder or mailbox while continuing to review the monitoring service's alerts and findings.
Domain with no one responsible for email security	Avoid silently deleting every report without first establishing whether the data is needed. Assign responsibility for reviewing the domain's email authentication.

Recommended Method: Move DMARC Reports to a Separate Folder

For most businesses, the most practical solution is to create a folder or label named DMARC Reports and automatically route the incoming reports there. This removes them from the main inbox without discarding potentially useful security information.

You can use the following methods for Gmail, Google Workspace, Outlook, or Microsoft 365.

Method 1: Automatically Filter DMARC Reports in Gmail or Google Workspace

Gmail allows you to create filters that label, archive, or delete incoming messages when they match specified conditions. The steps below are for Gmail in a desktop web browser.

Step 1: Open an existing DMARC report email

Open a report that you have received and inspect its subject and sender address. If the message is a genuine report, you can use its details to create a filter.

Step 2: Create a filter from the message

1. Open Gmail on your computer.
2. Find a DMARC report email in your inbox.
3. Select the message's More menu, usually represented by three dots.
4. Select Filter messages like these, if that option is available.
5. Review the search criteria before creating the filter.

Step 3: Choose what Gmail should do

Depending on your requirements, select one or more available actions:

• Skip the Inbox (Archive it): Keeps matching messages out of the inbox without deleting them.
• Apply the label: Assigns the messages a label such as DMARC Reports. Create the label if necessary.
• Delete it: Moves matching messages to Trash.

You can select multiple actions, such as applying the DMARC Reports label and skipping the inbox.

Step 4: Create the filter

Select Create filter. New incoming messages matching the selected conditions will be handled automatically.

If Gmail offers an option to apply the filter to matching existing conversations, select it only if you also want to process messages already in your mailbox.

Alternative: Create a Gmail filter using search criteria

If you want to configure the filter manually, open Gmail's advanced search options and use criteria based on the actual messages you receive. For example, you can filter by a known sender address or a distinctive subject phrase.

An illustrative Gmail search query might be:

subject:report domain:example.com

This is only an example, not a universal DMARC filter. It may match unrelated messages or miss genuine reports. Replace the example domain and refine the search based on your actual report messages. Test the search before creating the filter.

Important: Do not rely on the word DMARC alone. Many aggregate report emails do not include that exact word in their subject.

Official instructions: Create rules to filter your emails in Gmail.

Method 2: Automatically Move or Delete DMARC Reports in Outlook

Outlook supports rules that can move incoming messages into a folder or delete messages when they match specified conditions. The exact interface varies between classic Outlook, new Outlook, Outlook on the web, and Outlook.com.

Step 1: Create a dedicated folder

1. Open Outlook.
2. In your mailbox folder list, create a new folder named DMARC Reports.

Step 2: Create a rule from a report email

1. Find a DMARC report email.
2. Right-click the message or open its message options.
3. Select Rules and then Create rule, or use the equivalent rule-creation option in your Outlook version.
4. Choose the appropriate sender or other matching condition.
5. Select the action to move the message to the DMARC Reports folder.
6. Save the rule.

Step 3: Use more specific conditions when necessary

If reports arrive from many different providers, a sender-only rule may not be sufficient. Open the advanced rule settings and consider conditions supported by your Outlook version, such as subject text or sender address. Use multiple conditions or separate rules if needed.

For automatic deletion, choose the delete action instead of moving the message. Test the conditions first so that ordinary business emails are not deleted accidentally.

Depending on the Outlook version and rule options, you may also be able to run a rule against existing messages in a folder.

Official instructions: Manage email messages by using rules in Outlook.

Method 3: Use a Dedicated DMARC Reporting Address

For a business domain, a cleaner long-term approach is to use a dedicated address for aggregate reports instead of sending them directly to an employee's everyday inbox.

For example, a domain owner might use an address such as:

dmarc-reports@example.com

This is an illustrative address. You must create or configure the actual mailbox or alias with your email provider.

The domain's DMARC DNS record can then direct aggregate reports to that address using the rua tag. The address can be a monitored mailbox, a dedicated reporting service, or another appropriately managed destination.

Before changing the record, confirm that the new destination can receive and process the reports. If the destination belongs to a different domain, additional authorization may be required for external DMARC reporting. Follow the reporting provider's setup instructions.

For a business, consider using a DMARC monitoring platform that converts XML reports into readable dashboards and alerts. This reduces the need to inspect raw attachments manually.

Method 4: Should You Delete DMARC Reports Automatically?

Yes, automatic deletion is possible through mail filters or rules, but it should be a deliberate decision rather than the default recommendation.

There are three common approaches:

Approach	Benefit	Limitation
Move to a folder	Keeps reports available for investigation while cleaning up the inbox.	Uses mailbox storage and requires occasional review.
Archive or label	Reduces inbox clutter while keeping the messages searchable.	Reports remain in the mailbox and may still consume storage.
Delete automatically	Reduces clutter and avoids keeping unwanted messages in the mailbox.	Can remove useful evidence of spoofing or authentication problems.

If you choose automatic deletion, create narrow matching criteria and test them against several genuine reports first. Prefer moving the messages to a folder for a trial period, then decide whether deletion is appropriate.

In Gmail, the Delete filter action moves messages to Trash, where they are normally retained for up to 30 days before permanent deletion. Other email systems may have different retention policies.

Can You Stop DMARC Reports by Removing the rua Setting?

Removing the rua tag from the DMARC DNS record can stop aggregate reports from being requested at that destination, because the record no longer advertises that reporting address. However, it is not usually the best first step simply because the emails are annoying.

Consider the following points before changing DNS:

• Removing rua reduces the visibility you receive into authentication results.
• It does not disable SPF, DKIM, or DMARC evaluation by receiving mail systems.
• It does not prevent all spoofing or guarantee that fewer malicious emails will be sent.
• Receiving systems may have their own reporting behavior and implementation limitations.
• DNS changes may take time to propagate according to the relevant DNS caching and TTL behavior.

If you are certain that aggregate reporting is not required, your domain administrator can update the DMARC record through the authoritative DNS provider. Preserve a copy of the previous record before changing it, and verify that the remaining DMARC policy is valid afterward.

For most businesses, routing reports to a dedicated mailbox or a reporting service is preferable to disabling reporting altogether.

What Information Is Inside a DMARC Aggregate Report?

DMARC aggregate reports summarize authentication results for messages associated with the domain covered by the report. Common fields include:

Field or information	What it tells you
Reporting organization	The organization that generated the report.
Report date range	The period of email activity covered by the report.
Source IP address	The IP address of the system that sent the reported messages.
Message count	The number of messages represented by a result record.
SPF result	Whether SPF passed or failed for the evaluated identity.
DKIM result	Whether the evaluated DKIM signature passed or failed.
DMARC disposition	The reported policy and disposition, such as none, quarantine, or reject, where applicable.
Header From domain	The domain displayed in the message's From address and evaluated by DMARC.

A report can help identify which services send email using your domain and whether their messages authenticate correctly. However, a failed SPF or DKIM result does not automatically mean that the message is malicious. Legitimate services may be misconfigured, and authentication results must be interpreted in context.

How to Verify That Your Email Filter Works

After creating a Gmail filter or Outlook rule, use the following checks:

1. Confirm that the filter or rule is enabled.
2. Check whether the conditions match the genuine report emails you receive.
3. Use the email provider's search feature to find reports that arrived after the rule was created.
4. Confirm that matching messages appear in the intended folder or are handled by the chosen action.
5. Check that ordinary customer emails, invoices, password resets, and other important messages are not being moved or deleted accidentally.
6. Review the rule again if a reporting organization changes its sender address or subject format.

Most filters and rules affect future messages by default. Existing emails may require a separate option to apply the rule retrospectively.

Common Problems and Solutions

DMARC reports continue appearing in the inbox

Check whether the filter is enabled, whether the sender or subject condition matches the incoming messages, and whether another rule is overriding or affecting the result. If reports come from many providers, a single sender-based rule may not cover them all.

Some reports are filtered, but others are not

Different providers can use different sender addresses and subject lines. Review the messages that were missed and adjust the filter conditions. Avoid using a broad condition that could capture unrelated email.

Important emails are being deleted

Disable the filter or rule immediately, review its conditions, and recover messages from Trash or Deleted Items where possible. Recreate the rule with more specific criteria and test it before enabling automatic deletion again.

The XML attachment cannot be opened normally

Aggregate reports are machine-readable data, not conventional documents. They may also be compressed. Use an appropriate DMARC report parser or monitoring service instead of trying to read every attachment manually. Do not upload sensitive report data to an untrusted service.

Reports arrive even though the company sends very little email

Receiving systems may have processed messages that claim to use your domain, including unauthorized or spoofed messages. Review the report's source IP addresses and authentication results, and compare them with your known sending services before drawing conclusions.

Frequently Asked Questions

Are DMARC aggregate report emails spam?

Not necessarily. Genuine aggregate reports are automated email authentication feedback. They can be noisy and inconvenient, but they may contain useful security information. Unexpected messages should still be checked before trusting attachments or links.

Why do I receive DMARC reports from Google or Microsoft?

A participating Google or Microsoft receiving system may have processed email associated with your domain and generated an aggregate report for the reporting address listed in your DMARC record.

Can I move all DMARC reports into a folder automatically?

Yes. Create a Gmail filter or Outlook rule using conditions that match the report emails you receive, then choose an action such as applying a label or moving the messages to a dedicated folder.

Can I delete DMARC reports without affecting email delivery?

Deleting the report messages from your mailbox does not itself disable DMARC authentication or change how receiving systems evaluate messages. However, deleting the reports removes your access to that reporting data unless it is stored elsewhere.

Will removing rua disable DMARC?

No. Removing the rua tag removes that advertised aggregate reporting destination, but it does not itself disable DMARC evaluation. The other parts of the DMARC DNS record still need to be configured correctly.

Do I need to open every XML attachment?

No. A DMARC reporting service can process the XML data and present summaries, trends, and alerts. For most users, this is more practical than inspecting individual reports manually.

Can I use one reporting address for several domains?

Yes, a reporting address can be used in the DMARC records of multiple domains, provided the receiving mailbox or service supports the arrangement. External reporting authorization may be needed when the reporting address is on a different domain.

Does a DMARC report prove that my domain has been hacked?

No. A report may include legitimate messages, authentication misconfigurations, spoofing attempts, or other unexpected sending sources. Investigate the source IP addresses, message counts, and authentication results before deciding whether an incident has occurred.

What is the best option for a small business?

Create a dedicated DMARC Reports folder or mailbox and review reports periodically. If the domain supports important business communications or uses several sending services, consider a DMARC monitoring service rather than deleting the raw reports without monitoring their findings.

Conclusion

DMARC aggregate report emails are generated by participating receiving mail systems and delivered to the reporting addresses advertised in your domain's DMARC DNS record. They can arrive frequently because many independent providers may process messages associated with the same domain.

You do not need to read every report manually. Use Gmail filters or Outlook rules to keep the messages out of your main inbox, preferably by moving them to a dedicated folder. For business domains, ensure that the authentication data is still monitored through a suitable review process or DMARC reporting service before deciding to delete the reports or remove the rua setting.

Sources

• RFC 7489 – Domain-based Message Authentication, Reporting, and Conformance (DMARC)
• Microsoft Learn – Configure DMARC to Validate Email in Microsoft 365
• Google Gmail Help – Create Rules to Filter Your Emails
• Microsoft Support – Manage Email Messages by Using Rules in Outlook