Report Processing

MailShield automatically receives and processes email security reports, providing actionable insights about your email authentication.

Supported Report Types

DMARC Aggregate Reports (RUA)

Daily summaries sent by email receivers showing authentication results for emails claiming to be from your domain.

Report contents:

• Reporting organization (Google, Microsoft, Yahoo, etc.)
• Date range covered
• Your domain's published policy
• Source IPs that sent email
• Authentication results (SPF, DKIM, DMARC)
• Policy actions taken

Format: XML (often compressed as gzip or zip)

DMARC Forensic Reports (RUF)

Detailed reports about individual authentication failures.

Report contents:

• Full email headers
• Authentication failure details
• Source information
• Failure reasons

Format: AFRF (Authentication Failure Reporting Format)

INFO

Many email providers no longer send forensic reports due to privacy concerns. Aggregate reports are the primary data source. MailShield stores forensic reports sent to your Reporting address, but doesn't show them in the dashboard.

TLS-RPT Reports

Statistics about TLS connections to your mail servers.

Report contents:

• Reporting organization
• Date range
• Policy mode (testing/enforce)
• Successful connections
• Failed connections with reasons
• Failure categories

Format: JSON

How Reports Are Received

Setting Up Reporting

1. Copy your Reporting address. This is a full email address, such as abc123@reports.mailshield.app, shown in the header of the domain's Overview page and under Domain → Settings → Domain Information. Copy it as is. Don't add your domain name to it.
2. Update your DMARC record to include your Reporting address in the rua tag. If you already have a record, keep its policy and add the address to the existing rua tag. A new record could look like this:

v=DMARC1; p=none; rua=mailto:abc123@reports.mailshield.app

3. For TLS-RPT, add the same Reporting address:

_smtp._tls.example.com.  TXT  "v=TLSRPTv1; rua=mailto:abc123@reports.mailshield.app"

In both records, replace abc123@reports.mailshield.app with your own Reporting address.

Report Delivery

Email providers send reports:

• DMARC Aggregate: Daily (covering previous 24 hours)
• TLS-RPT: Daily or weekly

First reports typically arrive within 24-48 hours of configuration.

Report Processing Pipeline

Email received
    ↓
Extract attachment (gzip/zip)
    ↓
Parse XML/JSON content
    ↓
Validate and normalize data
    ↓
Look up sending IPs (network, country, reverse DNS)
    ↓
Flag forwarded mail
    ↓
Store in database
    ↓
Extract DKIM selectors
    ↓
Update statistics
    ↓
Generate alerts (if needed)

Automatic DKIM Discovery

MailShield automatically discovers DKIM selectors from DMARC reports:

1. Reports include DKIM authentication results
2. Each result contains the selector and signing domain
3. MailShield extracts new selector/domain pairs
4. Adds them to your monitored selectors
5. Begins checking those selectors

This means you don't need to add every DKIM selector by hand: they're discovered as reports arrive.

Report Analysis

Authentication Summary

For each domain, MailShield calculates:

Metric	Description
Total Messages	Emails sent as your domain, forwarded ones included
Passed	Messages that passed DMARC
Failed	Messages that failed DMARC
Forwarded	Messages forwarded from mailboxes such as Gmail or Outlook, counted apart (see Forwarded Mail)
DMARC Pass Rate	Passed messages as a percentage of passed plus failed. Forwarded mail doesn't move it

Passed, failed and forwarded add up to the total.

Source Analysis

Identify who's sending email as your domain:

• IP addresses of sending servers
• Provider identification (Google, Microsoft, etc.)
• Authorization status (in SPF or not)

Failure Analysis

Understand why emails fail:

• SPF failures: Unauthorized senders, or forwarding. Mail forwarded from mailbox providers is counted apart, see Forwarded Mail
• DKIM failures: Missing signatures, invalid keys
• Alignment failures: Domain mismatches

Report Alerts

With the High failure rates alert on, MailShield alerts you when:

• A DMARC report with at least 50 messages shows more than 20% of them failing
• The DMARC failure rate over the last 24 hours rises sharply above the domain's 14-day baseline
• A TLS report shows at least 5 failed sessions, and at least 5% of its sessions failed

Forwarded mail doesn't count toward these rates or toward the 50-message minimum. A high failure rate can mean someone is spoofing your domain, or a legitimate service isn't set up for SPF and DKIM yet. See Alerts.

Forwarded Mail

When someone forwards your mail from their Gmail, Outlook or other mailbox, the mailbox provider's servers send it on with your From address. SPF fails at the forwarding server by design, and DKIM passes if the signature survived the trip. DMARC reports list those servers next to your own, so MailShield counts their mail apart.

A report record counts as forwarded when all of these hold:

1. The sending server's hostname (its reverse DNS) belongs to a mailbox provider: Google (Gmail and Google Workspace), Microsoft (Outlook and Microsoft 365), Yahoo and AOL, iCloud, Proton, Fastmail, Zoho, GMX and Web.de, Yandex or Mail.ru.
2. SPF didn't pass aligned with your domain.
3. Your domain doesn't send through that provider, or DKIM passed aligned. Your domain sends through a provider when its SPF record includes the provider's SPF include, such as include:_spf.google.com or include:spf.protection.outlook.com, directly or through another include.

So if your domain uses Google Workspace and a message from Google's servers fails both SPF and DKIM, it still counts as a failure: it could be your own mail. Transactional and marketing services such as SendGrid or Amazon SES, and security gateways such as Mimecast, never count as forwarders. MailShield checks each record when the report arrives, against the domain's SPF record at that time.

Forwarded mail:

• Counts as neither passed nor failed. Reports show it as its own number.
• Doesn't count toward pass rates, the DMARC Progression checks or failure-rate alerts.
• Still counts toward the emails analyzed for your plan, like every message in a report.
• Needs no fix. Don't add Google or Microsoft to your SPF record because of it: that would let every Gmail or Microsoft 365 user pass SPF as your domain.

Report Storage

Reports are stored securely:

• Aggregate reports: Full report data retained
• Individual records: Parsed and indexed for analysis
• Historical access: View past reports anytime

Viewing Reports

Open Reports in the sidebar for all domains, or a domain's Reports tab. You can filter by domain, date range, reporter and status, and open any report for its per-source details. See Viewing Reports.

Importing Reports

To add reports you received before you started using MailShield, click Import on the Reports page and upload DMARC aggregate reports (.xml, .xml.gz or .zip) or TLS reports (.json). MailShield matches each report to a domain in your organization. The results list each file as imported, skipped (already imported), unmatched (for a domain you don't monitor) or failed.

Imported reports about mail from more than 3 days ago show in your reports and statistics, but they don't raise failure-rate alerts: they're history, not news.

Troubleshooting

No Reports Received

1. Verify DMARC record includes correct rua address
2. Check the address in rua matches the domain's Reporting address in MailShield exactly
3. Wait 24-48 hours for first reports. Providers only send reports once they've seen mail from your domain.
4. Verify DNS propagation of your DMARC record

Incomplete Data

Some reporters may:

• Not include all data fields
• Aggregate data differently
• Use varying report frequencies

Report Processing Errors

If a report fails to process:

• Invalid XML/JSON format
• Unsupported compression
• Malformed data

Failed reports are logged for investigation.