Connect DMARC reports

Receiving mail servers send DMARC aggregate reports to the addresses in your DMARC record's rua= tag. Adding MailGlo's address there is how MailGlo learns which services send as your domain and whether their mail passes.

Add MailGlo's address

1. Open the domain in Domains. The setup panel shows the exact DMARC value to publish: MailGlo's addresses in rua= and ruf=, with your current recipients kept.
2. Edit the _dmarc TXT record at your DNS provider and replace its value with that one. If you have no DMARC record yet, v=DMARC1; p=none; rua=...; ruf=... starts in monitoring mode, which changes nothing about delivery.
3. Or prepare a reviewed DMARC change from the domain's DNS records with “Add MailGlo as a report recipient”.

After you publish

MailGlo checks the record. Reports usually arrive within a day or two. Until then the domain shows “Waiting for first report”. Coverage shows which receivers reported and when, so a gap is visible instead of looking healthy.

Failure reports

A failure report describes one message that failed DMARC: which server sent it, which check failed and what the receiver did with it. Receivers send them to the addresses in your DMARC record's ruf= tag. Many receivers never send them, so they add detail to aggregate reports rather than replace them.

Failure reports are on by default, on every plan:

1. Setup adds MailGlo's failure-report address to ruf= together with its rua= address. Recipients already in ruf= stay. A domain whose record already sends reports to MailGlo shows the ruf= addition as a proposed change; nothing changes in your DNS until you publish it.
2. Once MailGlo sees the published record, it receives failure reports for the domain. A report about mail that arrived before then or while failure reports were off, or about a domain that is not yours, is set aside unread.
3. To turn them off, open the domain's Settings and switch off Receive failure reports. MailGlo sets new failure reports aside unread at once, and the DMARC value setup proposes leaves out its failure-report address; publish that value to stop receivers sending them.

What MailGlo keeps from each report: the reporting organization, when the message arrived, the sending IP address, the failed check, the delivery result, and the domains involved (the reported domain, the From domain, the DKIM domain and selector, the SPF domain and the domain of the return address). It also keeps a fingerprint of the message ID, so a report sent twice counts once.

What MailGlo never keeps: the message body, its subject, its recipients, any email address or any other header. The original report email stays in MailGlo's restricted mail archive and no screen or API shows it.

MailGlo keeps failure reports until you ask for them to be deleted. Like other reports, the list shows those inside your plan's report history, described below. To have them deleted, ask support, as Leaving the service describes. Anyone who can see a domain's report details can see its failure reports, on the domain's Reports page, reached from Overview.

Reports and history

The free plan shows 90 days of processed report history; Business plans show one year. Older reports are kept, not deleted, and return when your plan shows them.