> ## Documentation Index
> Fetch the complete documentation index at: https://jetemail.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# DMARC Monitoring

> Monitor DMARC authentication, sending sources, and receiver policy decisions for your domains.

<Info>
  DMARC Monitoring is currently in beta. The dashboard, report processing, and analytics may change as we improve the product.
</Info>

JetEmail DMARC Monitoring turns the aggregate XML reports sent by mailbox providers into authentication and policy analytics. It helps you discover every service sending as your domain, find SPF or DKIM alignment problems, and move towards an enforced DMARC policy with less risk.

You do not need to send mail through JetEmail to monitor a domain. Reports can include mail from JetEmail and any other sending service that uses your domain.

## How it works

<Steps>
  <Step title="Add a domain">
    JetEmail creates a unique aggregate reporting address for the domain, such as `5e2f617ea64848ab9073@rua.jetsmtp.net`.
  </Step>

  <Step title="Publish the reporting address">
    Add the generated address to the `rua` tag in the domain's existing DMARC record, or publish the complete starter record provided by JetEmail.
  </Step>

  <Step title="Receivers send reports">
    Participating mailbox providers send periodic aggregate reports to the address in `rua`. Reports normally cover a daily period, although timing and participation vary by provider.
  </Step>

  <Step title="Review the results">
    JetEmail validates and normalizes each report, then shows message-weighted authentication rates, sending sources, policy decisions, individual receiver reports, and the original XML.
  </Step>
</Steps>

<CardGroup cols={2}>
  <Card title="Set up your first domain" icon="rocket" href="/docs/dmarc/getting-started" arrow="true">
    Generate a reporting address and add it safely to DNS.
  </Card>

  <Card title="Understand the analytics" icon="chart-line" href="/docs/dmarc/analytics" arrow="true">
    Learn what the pass rates, sources, dispositions, and report details mean.
  </Card>
</CardGroup>

## What DMARC reports contain

Aggregate reports are statistical summaries, not copies of individual messages. Depending on what the receiver supplies, JetEmail stores and displays:

* The reporting organization and report period
* The published DMARC policy, alignment modes, and policy percentage
* Sending IP addresses and message counts
* The domain found in the visible `From` header
* Evaluated DMARC, DKIM, and SPF results
* DKIM signing domains, selectors, and results
* SPF domains, scopes, and results
* Receiver disposition: none, quarantine, or reject
* Policy override reasons and comments
* Report metadata and the original aggregate XML

Aggregate reports do not normally contain message bodies or a recipient-by-recipient delivery log.

## What counts as a DMARC pass

A message passes DMARC when at least one of these paths passes and aligns with the domain in the visible `From` header:

* **DKIM:** the signature validates and its signing domain aligns with the `From` domain
* **SPF:** the sending server is authorized and the envelope sender domain aligns with the `From` domain

Only one aligned path is required. A message can therefore pass DMARC when DKIM passes and SPF fails, or when SPF passes and DKIM fails.

<Warning>
  A high pass rate does not prove that every source is authorized. Review unknown sending networks and confirm each service belongs to your organization before enforcing a stricter policy.
</Warning>

## Regional storage and retention

Reports are routed to the log region configured for your JetEmail account: Australia, the United States, or Europe. Report data remains in regional ClickHouse hot storage for its first 30 days, then moves to R2-backed cold storage. Data becomes eligible for automatic deletion after 400 days.

The dashboard provides 7-day and 30-day analytics views. The DMARC API accepts custom date ranges within retained data.