ruf= in a DMARC record names where receivers may send failure reports, sometimes called forensic reports: individual reports about specific messages that failed DMARC. It takes mailto: addresses, like rua. Many mailbox providers do not send these reports at all, because they can contain message content and personal data.
Why it matters
Aggregate reports (rua) tell you how much mail fails. Failure reports can show an actual failing message, which helps when you are trying to work out why one sender fails. The catch is privacy. A failure report may include headers and sometimes parts of the body, so receivers are cautious, and you should handle anything you do receive with care. For most domains, rua is the report that does the real work.
How to do it
- Decide whether you need failure reports. If your aggregate reports are enough to find and fix senders, you can leave ruf out.
- If you want to try it, add the tag to the record at
_dmarc.example.com, using a mailbox with restricted access:
v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com; ruf=mailto:dmarc-failures@example.com
- Choose when reports are requested with the
fotag. RFC 7489 defines four values:
| fo value | Report requested when |
|---|---|
| 0 (default) | All underlying checks fail to give an aligned pass |
| 1 | Any underlying check does not give an aligned pass |
| d | DKIM fails, whether or not it is aligned |
| s | SPF fails, whether or not it is aligned |
You can combine values with colons, for example fo=1:d.
- The default report format, set by the
rftag, isafrf(the Abuse Reporting Format). You rarely need to change it. - Keep the mailbox private and delete reports once you have used them.
Common mistakes
- Expecting every receiver to send failure reports. Many do not, so a quiet inbox does not mean nothing is failing.
- Sending reports to a shared inbox that many people can read, when they may contain personal data.
- Using
fo=1on a busy domain without a plan for the volume it can bring. - Forgetting the
mailto:prefix. - Relying on ruf instead of rua. Always publish rua first.
Frequently asked questions
Is ruf the same as rua?
No. rua asks for daily summary reports, while ruf asks for reports about individual failing messages. See what rua= means.
Do I need ruf to pass DMARC?
No. The tag affects only reporting. Your mail passes or fails DMARC based on SPF, DKIM and alignment alone.
Is it safe to publish a ruf address?
It is safe as long as the mailbox is private and you treat the contents as sensitive. Think about your data protection obligations before collecting message samples.
Related guides
Curious how your domain's email records look? Try the free website sample.