DMARC Reports

DMARC aggregate reports are XML files that receiving mail servers send to your rua address. They show which messages passed or failed SPF, DKIM, and DMARC alignment checks, and which IPs are sending as you.

Point your rua= at Molted and reports are parsed and stored automatically. You can also upload a file by hand.

Point your rua at Molted

Publish a DMARC record on the domain you send from:

_dmarc.notifications.yourcompany.com.  TXT  "v=DMARC1; p=none; rua=mailto:dmarc@agent.molted.email"

The exact record for each of your domains is shown under DMARC reporting on the Domains page in the portal, ready to copy.

p=none is monitoring mode: it turns reporting on and changes nothing about how your mail is delivered. Collect a couple of weeks of data, confirm your legitimate senders align, then tighten to p=quarantine and eventually p=reject.

Reports usually start arriving within 24 hours (most providers send once a day). They show up in GET /v1/me/dmarc/reports like any uploaded report.

A few details worth knowing:

• Attribution is by the domain in the report, not the address it was sent to. A report only lands in your account if you have verified the domain it covers. Reports for a domain you do not own, or one you added but have not verified yet, are dropped.
• Mail that fails both SPF and DKIM is rejected. Every real reporter passes at least one.
• Subdomain reports roll up to the closest domain you have verified, so a report for mail.yourcompany.com lands in your account if you verified either mail.yourcompany.com or yourcompany.com.
• Reports never appear as inbound mail. They do not create threads, do not fire inbound webhooks, and are never classified by your agent.
• gzip and zip attachments are both handled, including archives holding more than one report.
• Malformed or non-DMARC mail sent to the reporting address is dropped silently.

Failure reports (ruf=) are not ingested.

Upload a report

Send the raw file base64-encoded. Plain XML, .gz, and .zip are all accepted.

POST https://api.molted.email/v1/me/dmarc/upload

curl -X POST https://api.molted.email/v1/me/dmarc/upload \
  -H "Cookie: YOUR_SESSION_COOKIE" \
  -H "Content-Type: application/json" \
  -d "{\"contentBase64\": \"$(base64 < report.xml.gz | tr -d '\n')\"}"

{
  "id": "report_abc123",
  "orgName": "google.com",
  "reportId": "12345678901234567890",
  "dateRangeBegin": "2026-03-30T00:00:00Z",
  "dateRangeEnd": "2026-03-30T23:59:59Z",
  "totalMessages": 142,
  "passCount": 140,
  "failCount": 2,
  "passRate": 0.986
}

Reports are deduplicated by (orgName, reportId). Uploading the same report twice is safe, and so is uploading one that already arrived through your rua address.

If the file holds more than one report (a zip with several entries), the first is returned in the top-level fields and the rest under additional.

Maximum file size is 5 MB.

List reports

GET https://api.molted.email/v1/me/dmarc/reports

curl "https://api.molted.email/v1/me/dmarc/reports?domain=notifications.yourcompany.com" \
  -H "Cookie: YOUR_SESSION_COOKIE"

Get report details

GET https://api.molted.email/v1/me/dmarc/reports/:id

curl https://api.molted.email/v1/me/dmarc/reports/report_abc123 \
  -H "Cookie: YOUR_SESSION_COOKIE"

{
  "id": "report_abc123",
  "orgName": "google.com",
  "reportId": "12345678901234567890",
  "dateRangeBegin": "2026-03-30T00:00:00Z",
  "dateRangeEnd": "2026-03-30T23:59:59Z",
  "totalMessages": 142,
  "passCount": 140,
  "failCount": 2,
  "passRate": 0.986,
  "dkimPassRate": 0.993,
  "spfPassRate": 0.986,
  "quarantineCount": 1,
  "rejectCount": 1,
  "uniqueSourceIps": 3,
  "policyPublished": {
    "domain": "notifications.yourcompany.com",
    "p": "reject",
    "sp": "reject",
    "pct": 100
  }
}

Domain authentication summary

Get aggregated pass rates across all uploaded reports for a domain.

GET https://api.molted.email/v1/me/dmarc/summary

curl "https://api.molted.email/v1/me/dmarc/summary?domain=notifications.yourcompany.com" \
  -H "Cookie: YOUR_SESSION_COOKIE"

{
  "domain": "notifications.yourcompany.com",
  "totalMessages": 4280,
  "passRate": 0.994,
  "dkimPassRate": 0.998,
  "spfPassRate": 0.994,
  "recentReports": 14
}

What to look for

A low pass rate on a new domain often indicates DNS records haven't propagated or are misconfigured. Compare policyPublished against your DNS entries.

Related reading

• Sending Domains -- adding and verifying domains with DKIM, SPF, and DMARC records