Help Center

Email diagnostics and DMARC reports

See who sends mail as your domain, whether it authenticates, and why it fails when it does.

Included with Smoo AI Support - Pro, Smoo Workforce + Support Bundle and 5 more plansSee plans

DMARC aggregate reports are a daily summary, sent to you by Google, Microsoft and everyone else who receives your mail, listing every IP that sent messages claiming to be your domain. Smoo receives them for you and turns them into a dashboard.

The single thing worth understanding: if your DMARC record is missing or points at the wrong address, providers send nothing at all — no bounce, no error. An empty dashboard is what a broken setup looks like, and it is identical to what clean mail looks like. That is why a domain with no reports is flagged in red rather than shown as an empty chart.

How to

  1. 1

    Under Destinations, add your sending domain.

    Smoo issues you a unique reporting address and shows the rua= tag to publish.

  2. 2

    Add that rua= tag to the TXT record at _dmarc.<your-domain>.

    Merge it into your existing DMARC record. Two v=DMARC1 records is an invalid policy and providers ignore both.

  3. 3

    Wait for the first report, then check Destinations shows "Receiving reports".

    Usually within 24 hours, occasionally 48. Until then the red warning is correct — nothing has arrived.

  4. 4

    Read the Reports tab: pass rate, the IPs sending as you, and who reported.

    Expand any failing source to see the raw auth_results next to the verdict.

If something goes wrong

The dashboard is empty and everything looks fine.
It is not fine. Empty means no reports were received, which nearly always means the rua= record is missing, misspelled or not yet propagated. Re-check the TXT record at _dmarc.<your-domain> against the value shown on Destinations.
A source shows DKIM failing but the raw results say pass.
That is alignment, not signing. A third-party sender signed with its own domain, which passes DKIM but does not align with your header From. Configure that vendor to sign with your domain, or authorise it in SPF.
An IP you do not recognise is sending as your domain.
Usually a forwarder (a mailing list re-sending your mail) rather than an impersonator. Check the raw auth_results — forwarders typically keep a valid DKIM signature and fail SPF.

Related