--- title: "RUA vs. RUF in DMARC: Reporting Types, Differences, and Configuration | AutoSPF" description: "Learn the key differences between DMARC RUA and RUF, including reporting types, privacy concerns, use cases, and configuration best practices." image: "https://autospf.com/og/blog/rua-vs-ruf-in-dmarc-reporting-types-differences-and-configuration.png" canonical: "https://autospf.com/blog/rua-vs-ruf-in-dmarc-reporting-types-differences-and-configuration/" --- Quick Answer RUA and RUF are DMARC reporting tags with different purposes. RUA delivers aggregate reports for monitoring email authentication, while RUF requests detailed failure reports for forensic analysis. RUA is widely supported; RUF has greater privacy concerns and limited availability. ## Try Our Free DMARC Checker Validate your DMARC policy, check alignment settings, and verify reporting configuration. [ Check DMARC Record → ](/tools/dmarc-checker/) Share [ ](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fautospf.com%2Fblog%2Frua-vs-ruf-in-dmarc-reporting-types-differences-and-configuration%2F "Share on LinkedIn") [ ](https://twitter.com/intent/tweet?text=RUA%20vs.%20RUF%20in%20DMARC%3A%20Reporting%20Types%2C%20Differences%2C%20and%20Configuration&url=https%3A%2F%2Fautospf.com%2Fblog%2Frua-vs-ruf-in-dmarc-reporting-types-differences-and-configuration%2F "Share on X/Twitter") [ ](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fautospf.com%2Fblog%2Frua-vs-ruf-in-dmarc-reporting-types-differences-and-configuration%2F "Share on Facebook") [ ](https://reddit.com/submit?url=https%3A%2F%2Fautospf.com%2Fblog%2Frua-vs-ruf-in-dmarc-reporting-types-differences-and-configuration%2F&title=RUA%20vs.%20RUF%20in%20DMARC%3A%20Reporting%20Types%2C%20Differences%2C%20and%20Configuration "Share on Reddit") [ ](mailto:?subject=RUA%20vs.%20RUF%20in%20DMARC%3A%20Reporting%20Types%2C%20Differences%2C%20and%20Configuration&body=Check out this article: https%3A%2F%2Fautospf.com%2Fblog%2Frua-vs-ruf-in-dmarc-reporting-types-differences-and-configuration%2F "Share via Email") ![DMARC RUA and RUF reports](https://media.mailhop.org/autospf/spf-lookup-6408-1788263994950.jpg) ## DMARC Reporting Basics: Why RUA and RUF Matter DMARC is an email authentication standard that builds on SPF and DKIM to help a domain owner detect spoofing, phishing, and unauthorized use of an email domain. A [DMARC record](https://autospf.com/dmarc-record-generator/) is published as a TXT record in DNS, and it tells a receiving email server how to evaluate messages using SPF, DKIM, identifier alignment, and the visible header from domain. **RUA and RUF** are two DMARC tag types used for reporting. They tell an email receiver where to send a DMARC report when mail is processed. RUA is used for aggregate report delivery, while RUF is used for forensic report delivery. Together, they support DMARC monitoring, DMARC compliance, and eventually DMARC enforcement. ### How DMARC reporting supports authentication visibility Without RUA or RUF, a [domain administrator](https://security.stackexchange.com/questions/104647/how-should-we-set-up-domain-administrators) may publish a DMARC policy but have limited visibility into actual email traffic. A DMARC report helps answer critical questions: - Which **IP address** sources are sending mail for the domain? - Are SPF and DKIM passing? - Is SPF or DKIM aligned with the header from domain? - Which email server or Internet Service Provider is accepting, quarantining, or rejecting messages? - Is a phishing attacker abusing the domain? _DMARC reporting is especially important for organizations in healthcare, financial services, government, and education, where domain security, compliance, and business reputation depend heavily on secure email authentication._ A reliable DMARC **Management Platform** can help organizations analyze DMARC reports, identify authentication issues, and strengthen [email security](https://autospf.com/).![Spf Record Checker 2411](https://media.mailhop.org/autospf/spf-record-checker-2411-1788260842752.jpg) ## What Is RUA? Aggregate Reports, Use Cases, and Data Included RUA stands for “Reporting URI for Aggregate reports.” The rua tag in a DMARC record specifies the email address where DMARC aggregate report data should be sent. These reports, typically delivered daily as [XML files](https://www.ni.com/docs/en-US/bundle/labview/page/xml-files.html?srsltid=AfmBOoqCOVqll28LoJU8I1qWCFKsfdO%5FBnD8x5GOQbCWX1lL6YYFD8Lx), provide insights into SPF, DKIM, and **DMARC authentication** results from participating [mailbox providers](https://en.wikipedia.org/wiki/Mailbox%5Fprovider). An aggregate report does not usually contain message content. Instead, it provides aggregate statistics about email authentication results. This makes RUA the most widely supported and operationally useful DMARC report type. ### Data included in a DMARC aggregate report A DMARC aggregate report usually includes: - Source IP address sending mail for the **email domain** - Message count by source - SPF authentication status - [DKIM](https://autospf.com/blog/how-dkim-works-a-comprehensive-guide-to-email-authentication/) authentication status - DMARC alignment results - Applied DMARC policy, such as none, quarantine, or reject - Receiving organization or reporter - Disposition taken by the email receiver Because an **aggregate report** summarizes email logs rather than exposing full message bodies, it creates fewer privacy concerns than RUF. _The dmarc rua report is the foundation of DMARC monitoring and helps identify legitimate email sender services, broken SPF record entries, missing DKIM record signing, and unauthorized senders._ ![Spf Lookup 6441](https://media.mailhop.org/autospf/spf-lookup-6441-1788260876571.jpg) ### Common RUA use cases RUA is useful during every stage of DMARC implementation. A domain owner can start with a relaxed **DMARC policy** such as `p=none`, collect an aggregate report from major receivers, and use that data to fix SPF, DKIM, and alignment issues before moving toward DMARC enforcement. For example, an organisation may discover through its DMARC aggregate reports that a [CRM](https://www.ibm.com/think/topics/crm), billing platform, or marketing service is sending legitimate email on its behalf but is not properly authorised through SPF or DKIM. _Using a DMARC report analysis tool, the domain administrator can investigate the sending source, verify the email service, correct authentication or alignment issues, and improve DMARC compliance before moving from p=none to p=quarantine or p=reject._ ## What Is RUF? Forensic Reports, Privacy Limits, and Practical Availability RUF is the DMARC tag used to specify Reporting URI(s) for failure reports. The ruf tag in a DMARC record identifies where a domain owner requests DMARC failure reports to be sent when a message fails **DMARC evaluation**. These reports are commonly known as forensic reports because they can provide detailed, message-level information about an individual authentication failure. Unlike an aggregate report, a forensic report may include portions of the original email, headers, authentication results, URLs, or [message metadata](https://dxstudio.msu.edu/social-media/sprinklr/analytics-research/message-metadata?sc%5Fsite=MarTech&sc%5Flang=en). In theory, this makes the dmarc ruf report useful for incident response, abuse investigation, takedown intelligence, and identifying malicious URLs used by a [phishing attacker](https://www.bleepingcomputer.com/news/security/fbi-warns-of-phishing-attacks-impersonating-us-city-county-officials/). ### Privacy limits and reduced RUF availability In practice, RUF is much less commonly supported than RUA. Many large mailbox providers and [Internet Service Provider](https://www.geeksforgeeks.org/computer-networks/isp-full-form/) networks restrict or do not send forensic report data because of privacy concerns. _A forensic report may expose personally identifiable information, message content, recipient addresses, or sensitive business communication._ This is why organizations such as healthcare providers, **financial services firms**, government agencies, and education institutions must treat RUF carefully. Even when a receiving email server supports RUF, the email receiver may redact content or send limited metadata only.![Spf Record Example 6728](https://media.mailhop.org/autospf/spf-record-example-6728-1788260913035.jpg) #### When RUF is still useful RUF can still be valuable when supported by the receiving organisation. A failure report may provide additional information about an individual message that failed DMARC evaluation, such as authentication results, relevant message headers, or other available metadata. This can help security teams **investigate suspicious email activity**, understand authentication failures, and identify potential abuse of their domain. Because RUF reports may contain sensitive information, organisations should evaluate their privacy, data-handling, retention, and security requirements before enabling failure reporting. Availability and the amount of information included in RUF reports can also vary between receiving mail systems. ## Key Differences Between RUA and RUF: Frequency, Detail, Security, and Compliance RUA and RUF are both DMARC reporting mechanisms, but they serve different operational purposes. ### **RUA vs. RUF side by side** | Area | RUA | RUF | | ------------- | ----------------------------------------------------- | ----------------------------------------------------------- | | Report type | Aggregate report | Forensic report | | Also known as | DMARC aggregate report, dmarc rua report | DMARC forensic report, failure report, dmarc ruf report | | Frequency | Usually daily | Near real-time if supported | | Format | XML report | Varies; may include headers or redacted samples | | Detail level | Summary-level aggregate statistics | Message-level failure details | | Privacy risk | Lower | Higher due to personally identifiable information | | Availability | Broadly supported | Limited support | | Best use | DMARC monitoring, source discovery, compliance status | Threat investigation, takedown intelligence, abuse analysis | RUA is the practical backbone of DMARC adoption because it provides reliable aggregate report data from many receivers. RUF is more specialized. It offers richer detail, but that detail creates privacy concerns and inconsistent availability. From a DMARC compliance perspective, RUA is usually essential. RUF is optional and should be deployed only when the organization has a clear process for **protecting sensitive information**. For domain security programs, the safest model is to use RUA broadly and RUF selectively.![Spf Flattening 3612](https://media.mailhop.org/autospf/spf-flattening-3612-1788260788665.jpg) ## How to Configure RUA and RUF Tags in a DMARC Record A DMARC record is published in DNS as a [TXT record](https://www.digicert.com/blog/what-is-a-txt-record) at `_dmarc.example.com`. The record includes a DMARC policy and optional reporting tags. The rua tag points to the mailbox or URI for aggregate report delivery. The ruf tag points to the mailbox or URI for forensic report delivery. ### DMARC record example with RUA and RUF Here is a basic dmarc record example: ``` _dmarc.example.com TXT "v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com; ruf=mailto:dmarc-forensics@example.com; fo=1; adkim=s; aspf=s" ``` In this DMARC record: - `v=DMARC1` identifies the record as DMARC. - `p=none` sets the DMARC policy to monitoring mode. - `rua=mailto:dmarc-reports@example.com` sends each aggregate report to the reporting address. - `ruf=mailto:dmarc-forensics@example.com` requests a forensic report for failures. - `fo=1` requests failure reporting when SPF or DKIM fails. - `adkim=s` and `aspf=s` require strict DKIM and SPF alignment. Before publishing, a domain administrator can use a DMARC Record Generator to create an accurate policy and minimize [syntax errors](https://www.hnrtech.com/tech-glossary/syntax-errors/). _After publishing, verify the TXT record in DNS settings and monitor DMARC reports to track SPF, DKIM, and DMARC authentication status._ ### External domain verification for reporting addresses If the reporting address is on a different domain, **external domain verification** is required. For example, if `example.com` wants reports sent to `reports.vendor.com`, the vendor domain must publish a DNS authorization record allowing it to receive DMARC report data for that email domain. This prevents attackers from abusing a DMARC tag to flood [third-party systems](https://en.wikipedia.org/wiki/Third%5FParty%5FSystem) with **XML report attachments**. Many managed services handle this automatically, but the domain owner should still confirm the configuration before relying on the DMARC report stream. For a mature [DMARC](https://autospf.com/blog/what-is-dmarc-email-authentication-guide/) implementation, start with RUA, review every aggregate report, fix SPF record and DKIM record issues, then progress toward quarantine or reject. Add RUF only when forensic report handling, privacy controls, mailbox retention, and **security workflows** are ready. ![Brad Slavin](https://media.mailhop.org/autospf/images/authors/brad-slavin.jpg) [ Brad Slavin ](/authors/brad-slavin/) General Manager Founder and General Manager of DuoCircle. Product strategy and commercial lead for AutoSPF's 2,000+ customer base. [LinkedIn Profile →](https://www.linkedin.com/in/bradslavin) ## Ready to get started? Try AutoSPF free — no credit card required. [ Book a Demo ](/book-a-demo/) Scan Your Domain Now Instantly scan your domain for DKIM, SPF, and DMARC issues Check My Domain Share this article [ ](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fautospf.com%2Fblog%2Frua-vs-ruf-in-dmarc-reporting-types-differences-and-configuration%2F) [ ](https://twitter.com/intent/tweet?text=RUA%20vs.%20RUF%20in%20DMARC%3A%20Reporting%20Types%2C%20Differences%2C%20and%20Configuration&url=https%3A%2F%2Fautospf.com%2Fblog%2Frua-vs-ruf-in-dmarc-reporting-types-differences-and-configuration%2F) [ ](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fautospf.com%2Fblog%2Frua-vs-ruf-in-dmarc-reporting-types-differences-and-configuration%2F) Copy Related Articles - [ ![DIY-ing SPF](https://media.mailhop.org/autospf/images/2024/04/spf-record-example-5874.jpg) 10 Reasons Why DIY-ing SPF isn’t a Good Choice for Companies Intermediate ](/blog/10-reasons-diy-ing-spf-isnt-good-choice-for-companies/) - [ ![phishing actors](https://media.mailhop.org/autospf/images/2025/11/spf-record-checker-0096.jpg) The 12.4 billion shield for your email communications: Why DMARC software is the unsung hero in the war against phishing actors! Intermediate ](/blog/12-4-billion-dmarc-software-shield-protecting-email-from-phishing-actors/) - [ ![SPF record](https://media.mailhop.org/autospf/images/2025/05/spf-record-generator-9003.jpg) 3 points to consider before setting your SPF record to -all (HardFail) Intermediate ](/blog/3-points-to-consider-before-setting-your-spf-record-hardfail/) - [ ![421 Error SMTP Guide](https://media.mailhop.org/autospf/spf-lookup-1607-1785756872932.jpg) 421 Error SMTP Survival Guide: Fix the 4.4.2 Connection Dropped Issue Intermediate ](/blog/421-error-smtp-survival-guide-fix-connection-dropped-email-issue/) ## Related Articles [ Intermediate 6m 10 Reasons Why DIY-ing SPF isn’t a Good Choice for Companies Apr 4, 2024 ](/blog/10-reasons-diy-ing-spf-isnt-good-choice-for-companies/)[ Intermediate 5m The 12.4 billion shield for your email communications: Why DMARC software is the unsung hero in the war against phishing actors! Nov 19, 2025 ](/blog/12-4-billion-dmarc-software-shield-protecting-email-from-phishing-actors/)[ Intermediate 3m 3 points to consider before setting your SPF record to -all (HardFail) May 22, 2025 ](/blog/3-points-to-consider-before-setting-your-spf-record-hardfail/)[ Intermediate 421 Error SMTP Survival Guide: Fix the 4.4.2 Connection Dropped Issue Aug 3, 2026 ](/blog/421-error-smtp-survival-guide-fix-connection-dropped-email-issue/) ```json {"@context":"https://schema.org","@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com","logo":{"@type":"ImageObject","url":"https://autospf.com/images/autospf-logo.png"},"description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138897474","https://www.linkedin.com/company/autospf","https://x.com/autospf01","https://www.g2.com/products/autospf/reviews"],"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://autospf.com/contact-us/"},"knowsAbout":["SPF Record Flattening","Sender Policy Framework","Email Authentication","DNS Management","DMARC","DKIM"]} ``` ```json {"@context":"https://schema.org","@type":"WebSite","name":"AutoSPF","url":"https://autospf.com","description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","publisher":{"@type":"Organization","name":"AutoSPF","url":"https://autospf.com","logo":{"@type":"ImageObject","url":"https://autospf.com/images/autospf-logo.png"},"description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}}} ``` ```json {"@context":"https://schema.org","@type":"BlogPosting","headline":"RUA vs. RUF in DMARC: Reporting Types, Differences, and Configuration","description":"Learn the key differences between DMARC RUA and RUF, including reporting types, privacy concerns, use cases, and configuration best practices.","url":"https://autospf.com/blog/rua-vs-ruf-in-dmarc-reporting-types-differences-and-configuration/","datePublished":"2026-09-01T00:00:00.000Z","dateModified":"2026-09-01T00:00:00.000Z","dateCreated":"2026-09-01T00:00:00.000Z","author":{"@type":"Person","@id":"https://autospf.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://autospf.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin is the founder and General Manager of DuoCircle, the company behind AutoSPF, DMARC Report, Phish Protection, and Mailhop. He founded DuoCircle in 2014 to solve the SPF 10-DNS-lookup problem at scale and has led the company's growth to 2,000+ customers. Brad's focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement) rather than hands-on DNS engineering.","image":"https://media.mailhop.org/autospf/images/authors/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"AutoSPF","url":"https://autospf.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com","logo":{"@type":"ImageObject","url":"https://autospf.com/images/autospf-logo.png"},"description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138897474","https://www.linkedin.com/company/autospf","https://x.com/autospf01","https://www.g2.com/products/autospf/reviews"],"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://autospf.com/contact-us/"},"knowsAbout":["SPF Record Flattening","Sender Policy Framework","Email Authentication","DNS Management","DMARC","DKIM"]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://autospf.com/blog/rua-vs-ruf-in-dmarc-reporting-types-differences-and-configuration/"},"articleSection":"intermediate","keywords":"","image":{"@type":"ImageObject","url":"https://media.mailhop.org/autospf/spf-lookup-6408-1788263994950.jpg","caption":"DMARC RUA and RUF reports"},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}} ``` ```json {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://autospf.com/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https://autospf.com/blog/"},{"@type":"ListItem","position":3,"name":"Intermediate","item":"https://autospf.com/intermediate/"},{"@type":"ListItem","position":4,"name":"RUA vs. RUF in DMARC: Reporting Types, Differences, and Configuration","item":"https://autospf.com/blog/rua-vs-ruf-in-dmarc-reporting-types-differences-and-configuration/"}]} ```