Skip to main content
DMARC Monitoring is currently in beta. The dashboard, report processing, and analytics may change as we improve the product.
JetEmail DMARC Monitoring turns the aggregate XML reports sent by mailbox providers into authentication and policy analytics. It helps you discover every service sending as your domain, find SPF or DKIM alignment problems, and move towards an enforced DMARC policy with less risk. You do not need to send mail through JetEmail to monitor a domain. Reports can include mail from JetEmail and any other sending service that uses your domain.

​
How it works

1

Add a domain

JetEmail creates a unique aggregate reporting address for the domain, such as 5e2f617ea64848ab9073@rua.jetsmtp.net.
2

Publish the reporting address

Add the generated address to the rua tag in the domain’s existing DMARC record, or publish the complete starter record provided by JetEmail.
3

Receivers send reports

Participating mailbox providers send periodic aggregate reports to the address in rua. Reports normally cover a daily period, although timing and participation vary by provider.
4

Review the results

JetEmail validates and normalizes each report, then shows message-weighted authentication rates, sending sources, policy decisions, individual receiver reports, and the original XML.

Set up your first domain

Generate a reporting address and add it safely to DNS.

Understand the analytics

Learn what the pass rates, sources, dispositions, and report details mean.

​
What DMARC reports contain

Aggregate reports are statistical summaries, not copies of individual messages. Depending on what the receiver supplies, JetEmail stores and displays:
  • The reporting organization and report period
  • The published DMARC policy, alignment modes, and policy percentage
  • Sending IP addresses and message counts
  • The domain found in the visible From header
  • Evaluated DMARC, DKIM, and SPF results
  • DKIM signing domains, selectors, and results
  • SPF domains, scopes, and results
  • Receiver disposition: none, quarantine, or reject
  • Policy override reasons and comments
  • Report metadata and the original aggregate XML
Aggregate reports do not normally contain message bodies or a recipient-by-recipient delivery log.

​
What counts as a DMARC pass

A message passes DMARC when at least one of these paths passes and aligns with the domain in the visible From header:
  • DKIM: the signature validates and its signing domain aligns with the From domain
  • SPF: the sending server is authorized and the envelope sender domain aligns with the From domain
Only one aligned path is required. A message can therefore pass DMARC when DKIM passes and SPF fails, or when SPF passes and DKIM fails.
A high pass rate does not prove that every source is authorized. Review unknown sending networks and confirm each service belongs to your organization before enforcing a stricter policy.

​
Regional storage and retention

Reports are routed to the log region configured for your JetEmail account: Australia, the United States, or Europe. Report data remains in regional ClickHouse hot storage for its first 30 days, then moves to R2-backed cold storage. Data becomes eligible for automatic deletion after 400 days. The dashboard provides 7-day and 30-day analytics views. The DMARC API accepts custom date ranges within retained data.