DMARC Aggregate Reporting for PowerMTA: Setup and Analysis

If you run PowerMTA for high-volume outbound mail and your DMARC record still sits at p=none, you are missing the only free, standards-based feedback loop that shows exactly how receiving networks evaluate your authentication. DMARC aggregate reporting for PowerMTA gives you a daily XML feed of pass/fail results for SPF and DKIM across every mailbox provider that honours your rua= tag. Without it, you discover alignment problems only when you get blocked.

By the end of this guide you will know how to publish a RUA record safely, configure PowerMTA so that your mail actually passes DMARC, parse the resulting reports with open-source or managed tools, and fix the most common SPF and DKIM failures. You will also see how a Windows desktop tool like PMTAcore can automate the repetitive DNS and signing-key work once you understand it manually.

What Are DMARC Aggregate Reports?

A DMARC aggregate report is an XML document sent by a receiving mail server to the address you publish in your DMARC record's rua tag. It arrives once per day, typically as a gzip-compressed attachment. The report contains no message content or recipient addresses, only aggregated authentication results for messages that used your domain in the RFC 5322 From header. Each report includes metadata such as the reporting organisation, the date range, and the published DMARC policy, followed by a list of sending IP addresses with counts, disposition outcomes, SPF results, DKIM results, and alignment checks.

Mailbox providers like Gmail, Yahoo, Microsoft, and others send these reports when they see your domain and support DMARC reporting. Not every receiver sends reports, but the ones that do cover most of the world's inboxes. The question "What am I supposed to do with DMARC reports?" has a practical answer: use them to identify sending infrastructure that fails authentication, detect unauthorised use of your domain, and monitor the impact of configuration changes before moving to a stricter policy.

Setting Up RUA in Your DMARC Record

The RUA setup starts with a dedicated mailbox. Create an address like dmarc-reports@pmtasender.net that can receive message attachments. Then publish a TXT record at _dmarc.pmtasender.net with a DMARC policy that includes the rua tag. Start with p=none to monitor without affecting delivery.

v=DMARC1; p=none; rua=mailto:dmarc-reports@pmtasender.net; ruf=mailto:dmarc-forensics@pmtasender.net; fo=1; adkim=s; aspf=s; pct=100

Here rua defines aggregate report recipients, ruf defines forensic report recipients, fo=1 requests forensic reports for failed messages, adkim=s and aspf=s enforce strict identifier alignment, and pct=100 applies the policy to all mail. You may provide multiple rua addresses separated by commas. Verify the record with a DMARC checker, then wait 24 to 48 hours for the first reports.

Configuring PowerMTA to Send DMARC-Aligned Email

DMARC passes when at least one of SPF or DKIM passes and aligns with the domain in the From header. For SPF alignment, the envelope sender domain, also called the return-path or MAIL FROM domain, must match the From domain. For DKIM alignment, the signing domain (d= tag) must match the From domain. With relaxed alignment, both can share the same organisational domain; with strict alignment, they must match exactly.

In PowerMTA, configure DKIM signing inside a <domain> block. The following example signs all mail for the domain mail.pmtasender.net using selector pmta1 and an RSA private key at /etc/pmta/dkim/pmta1.key.

# /etc/pmta/config
<domain mail.pmtasender.net>
    dkim-sign yes
    dkim-selector pmta1
    dkim-private-key /etc/pmta/dkim/pmta1.key
    dkim-canonicalization relaxed/relaxed
</domain>

Then publish the matching DKIM public key in DNS at pmta1._domainkey.mail.pmtasender.net. For SPF, ensure your PowerMTA source IPs are listed in the domain's SPF record. For example:

pmtasender.net.  TXT "v=spf1 ip4:192.0.2.10 ip4:192.0.2.11 include:spf.pmtasender.net -all"
mail.pmtasender.net. TXT "v=spf1 include:spf.pmtasender.net -all"

Manual setup across many sending domains is repetitive and error-prone. PMTAcore's PowerMTA management can generate the DKIM signing configuration and push the matching public keys and SPF records to your DNS provider. Its DNS automation applies the records to Cloudflare, GoDaddy, or Namecheap without manual copy-paste.

Tools for Analyzing DMARC Reports (Including Open-Source Options)

Raw DMARC XML is not meant to be read as plain text. You need a parser that aggregates the data across days and domains. The following tools range from command-line utilities to hosted dashboards.

• parsedmarc — Open-source Python CLI that reads reports from an IMAP mailbox and outputs JSON or CSV.
• dmarcts-report-viewer — Self-hosted PHP/MySQL web interface for viewing DMARC reports.
• Postmark DMARC Digests — Free weekly email summaries with a simple pass/fail breakdown.
• MxToolbox DMARC Analyzer — Hosted tool for quick visual checks of aggregate data.
• Valimail / PowerDMARC — Commercial SaaS platforms with alerting, historical trending, and multi-domain support.

Tool	Type	Best for	Notes
parsedmarc	Open-source CLI	Technical teams wanting raw JSON/CSV	Requires Python and IMAP ingestion
dmarcts-report-viewer	Open-source web	Self-hosted dashboard	PHP/MySQL setup needed
MxToolbox DMARC Analyzer	Hosted	Quick visual checks	Free tier limited
Valimail / PowerDMARC	Commercial SaaS	Enterprise monitoring	Advanced alerting and forensics

To read a DMARC aggregate report effectively, follow this order:

1. Sort source IPs by message count descending.
2. Filter for rows where SPF or DKIM result is fail.
3. Identify whether the IP belongs to your known PowerMTA infrastructure.
4. Check the disposition column to see if receivers applied none, quarantine, or reject.
5. Map failures to the configuration changes needed in PowerMTA or DNS.

Common DMARC Failures and How to Fix Them in PowerMTA

SPF alignment failure

This occurs when the envelope sender domain does not align with the From header domain. In PowerMTA, the return-path domain is controlled by the <domain> block or the bounce address pattern. If you send as news@pmtasender.net, the MAIL FROM command must also originate from a domain that aligns with pmtasender.net. Check your PowerMTA source and domain configuration to ensure the bounce domain matches.

DKIM alignment failure

This usually means the d= value in the DKIM signature does not match the From domain, or the signature is invalid because the public key is missing or the selector is wrong. Verify that the domain in your <domain> block equals the From domain, that the private key path is correct, and that the public key is published at <selector>._domainkey.<domain>. Use the SMTP tools in PMTAcore to test a live connection and inspect the DKIM signature returned by your PowerMTA server.

Missing or misconfigured DMARC record

If no valid DMARC record exists, receivers will not send aggregate reports and will apply their own local policies. Publish a record with a syntactically valid policy and at least one rua address. A common question is "Does DMARC need both SPF and DKIM?" The answer is no. DMARC passes if either SPF or DKIM passes and aligns. However, configure both because SPF often breaks with email forwarding, while DKIM usually survives. After fixing DMARC failures, check your sending IP reputations with PMTAcore's IP blacklist checker to see whether earlier authentication gaps led to listing.

When you need to send campaigns on top of PowerMTA, Choco Mailer adds multi-threaded sending with real-time open and click tracking, and it integrates with SMTP, Microsoft Graph API, or Firebase. See Choco Mailer for details.

Start with PMTAcore's free trial to see how automatic DNS record generation and PowerMTA configuration remove the manual steps from DMARC setup. Download the trial and analyse your first aggregate reports within a day.