Informes forenses (RUF)

Forensic reports (RUF) are per-message failure reports sent by email providers when a message fails DMARC authentication. Unlike aggregate reports, which summarize traffic over a day, forensic reports contain detailed information about individual email messages.

RUF vs RUA: What is the difference?

	RUA (Aggregate)	RUF (Forensic)
Format	XML attachment	AFRF email (RFC 6591)
Frequency	Daily summary	Per failing message
Coverage	All messages	Only authentication failures
Detail level	Statistical	Individual message detail
Provider support	Universal	Limited (see below)

Both report types are received automatically through the same IMAP mailbox. DMARC Examiner classifies and processes each type separately.

What information do forensic reports contain?

Each forensic report includes:

Source IP — The IP address of the server that sent the message
From address — The envelope sender (MAIL FROM) of the original message
Reported domain — The domain that failed DMARC alignment
Failure type — Which check failed: DMARC, SPF, or DKIM
Delivery result — What the receiving server did with the message (delivered, spam, rejected, or other)
SPF result — Pass or fail, including the SPF domain checked
DKIM result — Pass or fail, including the DKIM domain and selector
DMARC result — The overall DMARC evaluation result
Arrival date — When the message was received by the reporting server
Original headers — The full headers of the original message (collapsible in the UI)
Subject — The subject line of the original message (when included by the provider)

Plan availability

Forensic reports are available on Basic plan and above. Free plan accounts do not receive or store forensic reports.

If your account is on the Free plan, the Forensic tab displays an upgrade prompt. Forensic reports received while on the Free plan are discarded and cannot be recovered after upgrading.

Which providers send forensic reports?

Not all email providers send RUF reports. Support varies significantly:

Provider	Sends RUF
Gmail / Google Workspace	No
Yahoo / Yahoo Mail	No
Microsoft / Outlook / Exchange	Limited
Proofpoint	Yes
Mimecast	Yes
Barracuda	Yes

Because major consumer providers do not send forensic reports, it is normal to receive far fewer RUF reports than RUA reports. The absence of forensic reports does not indicate a problem with your DMARC configuration.

Viewing forensic reports

From the sidebar menu, click on Reports. The page displays two tabs: Aggregate and Forensic. Click the Forensic tab to see the list of forensic reports.

List view

The forensic reports table displays:

Source IP — The sending IP address
From — The envelope sender address
Domain — The reported domain
Failure Type — The authentication check that failed (DMARC, SPF, or DKIM)
Delivery Result — The action taken by the receiver
Date — The arrival date of the original message

On mobile, the table is replaced by a card layout with the same information.

Filters

Use the filters above the table to narrow down reports:

Domain — Show reports for a specific domain
Date from / Date to — Filter by arrival date range
Source IP — Filter by the sending IP address
Failure type — Filter by DMARC, SPF, or DKIM failures

Report detail

Click any row to open the full forensic report detail page. The detail view shows:

Summary cards — Source IP (with geolocation and organization), sender address, reported domain, and failure type
Authentication Results — SPF, DKIM, and DMARC result badges with the domains checked
Delivery — The action the receiving server took
Original Headers — A collapsible section with the full headers of the original message in monospace format