Automate a weekly DMARC report summary from your report mailbox

When you publish a DMARC record with a rua tag, receivers send aggregate reports about mail that claims to come from your domain. RFC 7489 section 7.2 says the aggregate data must be an XML file that should be gzip compressed. The ri tag in section 6.3 sets the interval requested between reports, with a default of 86400 seconds, which is 24 hours. Each receiving provider sends its own files, so they add up quickly. Every file is accurate and almost unreadable by eye, so most teams leave the mailbox alone until something breaks. The useful questions are simple: who is sending as us, which of those senders pass SPF and DKIM, and which are failing quietly. A weekly summary answers them while there is still time to fix a sender, and it gives you a dated record to compare against next week.

You add the job and give read access to the mailbox that receives reports. Each week a scheduled agent opens the new attachments, unzips them, and reads the records: sending source, message count, the SPF and DKIM results, whether each was aligned, and the disposition the receiver applied. It groups by source, flags those that fail alignment, and compares the week with the one before. It does not guess intent. An unknown source stays marked unknown until you say whether it is yours.

The CTO agent, as department head, reviews the summary before it goes out: do the counts add up across reports, is a failing source really failing both checks, is any suggested step safe to try. Then you approve, edit or skip it, and nothing is sent until you do. The usual path is to keep the policy at none while the summary shows every legitimate sender passing, fix the stragglers one by one, and then consider a stricter policy yourself.