> ## Documentation Index
> Fetch the complete documentation index at: https://docs.instantcampaign.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# DMARC reports

> How InstantCampaign collects DMARC aggregate reports for your domain without touching your mail hosting, and how to read the DMARC alignment column.

DMARC aggregate reports are daily summaries that mailbox providers such as Google and Microsoft send about mail that claims to come from your domain: how much of it passed SPF and DKIM *in alignment* with your from address. InstantCampaign collects these reports for you and shows the result in the **DMARC alignment** column on the [Deliverability](/guides/sending-and-workspace/deliverability) page.

## How it works

You don't have to change your MX records or your mail hosting. Receivers send the reports to an address on **our** domain, and that address is unique to your domain:

```
rua=mailto:ic-<token>@dmarc.instantcampaign.ai
```

You change exactly one DNS record, the `_dmarc` TXT record, which you'd be editing anyway to turn on DMARC reporting.

<Note>
  Normally a mailbox provider only sends reports to another domain if that domain explicitly agrees to receive them. We publish that authorization on our side for every customer domain, so there's nothing extra for you to add.
</Note>

## Set it up

<Steps>
  <Step title="Add and verify your domain">
    Go to **Settings → Domain Authentication** and add your sending domain. See [Sender identity and domain authentication](/guides/sending-and-workspace/sender-and-domains).
  </Step>

  <Step title="Copy the DMARC record">
    Expand the domain and copy the **DMARC Record** value exactly as shown. It includes your domain's unique `rua=` address.
  </Step>

  <Step title="Publish it at _dmarc">
    At your DNS provider, create or update the TXT record at `_dmarc.<your-domain>` with that value.
  </Step>

  <Step title="Wait for the first reports">
    Receivers usually send reports once a day, so it can take a day or two after you start sending for data to appear.
  </Step>
</Steps>

### If you already have a DMARC record

A domain can only have one `_dmarc` TXT record. Don't create a second one. Instead:

* Keep your existing policy (`p=`) if it's already `quarantine` or `reject`. The `p=none` in our suggested record is only a safe starting point.
* Add our address to your `rua=` tag. You can list several mailboxes separated by commas, so an agency or monitoring tool can keep its own address alongside ours. For example:

```
v=DMARC1; p=quarantine; rua=mailto:dmarc@agency.example,mailto:ic-<token>@dmarc.instantcampaign.ai
```

## Reading the DMARC alignment column

| What you see                             | Meaning                                                                                                                                                                      |
| ---------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **No reports** / "no rua data in window" | No aggregate reports covered this domain in the reporting window. The record may be missing or new, or you haven't sent enough mail yet.                                     |
| A percentage shown as healthy            | 95% or more of reported mail passed DMARC alignment.                                                                                                                         |
| A percentage shown as a warning          | Less than 95% passed. Some mail claiming to be from your domain isn't aligned. That could be a service sending on your behalf without DKIM, or someone spoofing your domain. |

The hint under the percentage shows how many days in the window had a report. The percentage is averaged only over days that were reported. Open the domain's row to see **DMARC coverage**: reported days out of the total.

## When DMARC reporting blocks sending

If your `_dmarc` record stops pointing at our reporting address (for example, someone edits the record and removes our `rua=` mailbox), the **Check DNS** drift check flags it. The pre-send check then blocks campaign sends from that domain with a **DMARC reporting** finding.

Your authentication is unaffected, but alignment can no longer be verified. Put our address back in the `rua=` tag, then click **Check DNS** on the Deliverability page.

<Tip>
  Domains added before per-domain reporting addresses existed may still point `rua=` at a mailbox on your own domain. The drift check names the exact address to add. Copy the current **DMARC Record** from **Domain Authentication** and republish it.
</Tip>

## Troubleshooting

<AccordionGroup>
  <Accordion title="Still no reports after a few days">
    Check that the TXT record is at `_dmarc.<your-domain>` (not at the root), that there's only one DMARC record, and that the `rua=` address matches the one shown under Domain Authentication exactly. Also make sure you've actually sent mail from the domain to providers that send reports, such as Gmail or Outlook.
  </Accordion>

  <Accordion title="Alignment is low">
    Look for services that send as your domain without being authenticated for it, such as a CRM, helpdesk or invoicing tool. Set up DKIM for each one on your domain, or send them from a subdomain.
  </Accordion>
</AccordionGroup>