DMARC reports: understand and organize them with a Gmail filter

Publié le 06 novembre 2026

Glowing neon envelope symbol on a black background, evoking email security and DMARC reports

One morning, an email from Google lands in your inbox with the subject “Report domain: votre-domaine.fr Submitter: google.com Report-ID: …” and a compressed attachment. The next day, Microsoft sends something similar, followed by Yahoo and others. No message, no explanation, just a file. Phishing? A hack? Neither: these are aggregate DMARC reports, and they are actually good news.

Here is what they tell you, how to read them in two minutes, and above all how to clear them from your inbox without losing them, using a little-known Gmail feature: importing filters from an XML file.

DMARC in thirty seconds

When a server receives an email claiming to come from votre-domaine.fr, it checks two things:

SPF: is the sending IP address on the list of servers authorized by your domain?
DKIM: does the message carry a valid cryptographic signature added by a server holding your domain's key?

DMARC brings the two together. It requires at least one check to pass and to be “aligned,” meaning it concerns the same domain shown in the “From:” field seen by the recipient. It also tells the receiving server what to do when authentication fails, through a simple TXT DNS record at _dmarc.votre-domaine.fr:

v=DMARC1; p=none; rua=mailto:dmarc@votre-domaine.fr

The p parameter sets the policy: none (monitor only), quarantine (send to spam), or reject (refuse outright). And the rua parameter explains those mysterious emails.

Why you receive these reports

rua means reporting URI for aggregate reports. It asks major email providers to send a summary, usually once a day, of messages they received claiming to come from your domain. If you receive these reports, your address is listed in that parameter.

Often you did not add it yourself. Since February 2024, Gmail and Yahoo have required a DMARC record from bulk senders, and many hosting companies, service providers and setup assistants create one automatically, putting the domain contact address in rua. The reports then arrive without warning.

Advertising

Remember: a report is not an alert. Google sends one even when everything is working perfectly. It is a statement, not a warning.

Read a report without a tool

The attachment is a compressed XML file: .zip from Google, .gz from Microsoft and most others. Extract it and open it in a browser or text editor. Below the header, which identifies the reporting organization and the covered period (as Unix timestamps, easily converted to dates online), each <record> block looks like this:

<record>
  <row>
    <source_ip>203.0.113.25</source_ip>
    <count>14</count>
    <policy_evaluated>
      <disposition>none</disposition>
      <dkim>pass</dkim>
      <spf>fail</spf>
    </policy_evaluated>
  </row>
  <identifiers>
    <header_from>votre-domaine.fr</header_from>
  </identifiers>
</record>

In plain English: 14 messages were sent from IP address 203.0.113.25 claiming to be from your domain. DKIM passed, SPF failed, but because one of the two is enough, DMARC passed. disposition tells you how the receiver handled the messages: none means they were delivered normally.

Three cases to recognize

Everything shows pass from your email host's IP addresses: this is normal and requires no action.
SPF fails, DKIM passes: very common with automatic forwarding and mailing lists, which resend your message through their own servers. As long as DKIM holds, the message passes.
Everything shows fail from an unknown IP: either a legitimate service you forgot to authorize (newsletter software, CRM, website notifications) or someone spoofing your domain. Looking up the IP usually helps distinguish the two.

If you manage several domains or large volumes, specialized services (Postmark, dmarcian, EasyDMARC and others) turn these files into readable dashboards, often with a free plan. Just point rua to the address they provide.

The trick: import a Gmail filter from an XML file

Reports are useful when something goes wrong, but they do not belong in your everyday inbox. The obvious solution is to create a filter manually. There is a faster, more shareable option: Gmail can import ready-made filters from an XML file. This is the same format Gmail generates when exporting filters, making it easy to reinstall a rule on another account in just a few clicks.

Copy the text below into a text file named filtre-dmarc.xml:

<?xml version='1.0' encoding='UTF-8'?>
<feed xmlns='[http://www.w3.org/2005/Atom](http://www.w3.org/2005/Atom)' xmlns:apps='[http://schemas.google.com/apps/2006](http://schemas.google.com/apps/2006)'>
  <title>Mail Filters</title>
  <id>tag:mail.google.com,2008:filters:1</id>
  <updated>2026-11-06T12:00:00Z</updated>
  <entry>
    <category term='filter'></category>
    <title>Mail Filter</title>
    <id>tag:mail.google.com,2008:filter:1</id>
    <updated>2026-11-06T12:00:00Z</updated>
    <content></content>
    <apps:property name='subject' value='&quot;Report domain&quot;'/>
    <apps:property name='hasAttachment' value='true'/>
    <apps:property name='label' value='Rapports DMARC'/>
    <apps:property name='shouldArchive' value='true'/>
    <apps:property name='shouldMarkAsRead' value='true'/>
    <apps:property name='shouldNeverSpam' value='true'/>
  </entry>
</feed>

The criterion combines the subject “Report domain,” recommended by the DMARC standard and used by Google, Microsoft and most providers, with the presence of an attachment. The actions apply the “Rapports DMARC” label, remove the message from the inbox, mark it as read and prevent it from being sent to spam.

Import the filter

In Gmail, first create the Rapports DMARC label (left sidebar, “Labels,” then the + button).
Click the gear icon at the top right, then See all settings.
Open the Filters and Blocked Addresses tab.
At the bottom, click Import filters, choose your filtre-dmarc.xml file, then click Open file.
Gmail displays the detected filter. Check Also apply new filters to existing conversations to organize reports already received, then confirm with Create filters.

The same file can contain several <entry> blocks: you can group all your rules and reinstall them together on a new account. To start from a real example, select an existing filter in the same tab and click Export: Gmail will provide the corresponding XML file.

What if you want to stop receiving them altogether?

Do not delete the DMARC record: it protects your domain against spoofing and helps ensure delivery to Gmail and Yahoo. Simply remove the rua=… parameter from the _dmarc TXT record in your domain's DNS zone, or replace it with a dedicated address. Reports will stop once the change propagates, usually within 24 to 48 hours.

One tip, though: keep them for at least a few weeks, organized under their label. They are the only way to verify that all your sending tools are properly authorized before tightening your policy from p=none to p=quarantine, then p=reject—the real protection against domain impersonation.