Set up DMARC reporting and review your first report

DMARC reporting provides genuine, concrete visibility into how your email authentication is actually performing in the real world — rather than simply trusting that your SPF and DKIM configuration is working correctly, these reports show you actual data about legitimate and potentially fraudulent email claiming to originate from your domain.

Setting this up requires configuring your DMARC record to include reporting addresses, which then begin receiving periodic aggregate reports from mail systems that process email claiming to be from your domain — these reports detail which sending sources are being seen, whether they're passing or failing your authentication checks, and patterns worth investigating.

Reviewing your genuine first report provides real, concrete baseline understanding of your actual email ecosystem — this often reveals legitimate sending sources you may have forgotten to explicitly authorize in your SPF record, third-party tools sending on your behalf that need proper authentication configuration, and sometimes genuine evidence of spoofing attempts worth being aware of.

This reporting data becomes the actual evidence base informing your progression toward stricter DMARC enforcement discussed elsewhere in this broader email security work — moving to more restrictive policies without first understanding your genuine sending ecosystem through this reporting data risks inadvertently blocking your own legitimate email sources that weren't properly accounted for in your initial configuration.