> ## Documentation Index
> Fetch the complete documentation index at: https://docs.apollodeploy.com/llms.txt
> Use this file to discover all available pages before exploring further.

# DMARC reports

> Import aggregate reports and analyze SPF, DKIM, alignment, and disposition

The **DMARC** page turns aggregate mailbox-provider reports into project-level authentication evidence.
Use it to see which sources send for your domains and whether SPF and DKIM align with the visible From domain.

## Import a report

Import one file at a time.
Signal accepts `.xml`, `.gz`, `.gzip`, `.zip`, and `.eml` files.
The result identifies newly imported reports and duplicates.

<Steps>
  <Step title="Obtain the aggregate report">
    Use a report sent to the rua destination in your DMARC record or exported from your reporting mailbox.
  </Step>

  <Step title="Preserve the original file">
    Do not edit provider XML before import.
    Keep the original if your operational policy requires evidence retention.
  </Step>

  <Step title="Import">
    Open **DMARC**, choose the file, and review the imported and duplicate counts.
  </Step>

  <Step title="Investigate sources">
    Find unexpected source IPs, authentication failures, or disposition changes.
  </Step>
</Steps>

## Time ranges

Choose 30 minutes, 1 hour, 6 hours, 12 hours, 24 hours, 7 days, 30 days, 90 days, or a custom range up to 90 days.
A short range helps incident work; a longer range establishes normal sender inventory.

## Metrics

| Metric            | Meaning                                                                |
| ----------------- | ---------------------------------------------------------------------- |
| Observed messages | Message count represented by imported aggregate data                   |
| DMARC alignment   | Messages where an authenticated identifier aligns with the From domain |
| DKIM alignment    | DKIM signing domain alignment                                          |
| SPF alignment     | Envelope sender domain alignment                                       |
| Reports           | Aggregate files represented in the selected window                     |
| Sources           | Distinct sending sources reported for the domain                       |

## Dispositions

A report can show pass or policy actions such as `none`, `quarantine`, or `reject`.
Investigate an unexpected source before authorizing it in SPF or changing policy.
Adding every observed sender to SPF can legitimize abuse and exceed SPF lookup limits.

<Warning>
  DMARC aggregate data is delayed and summarized.
  Use it for authentication analysis, not real-time per-recipient delivery tracking.
</Warning>

## SDK example: DMARC advisor signals

The public SDK does not expose DMARC report import or report-list operations. Keep file import and
report inspection in the dashboard. The public metrics advisor does expose the project's DMARC
alignment, policy, domain, observed-message, and recommendation signals:

<CodeGroup dropdown>
  ```typescript TypeScript theme={"dark"}
  const advisor = await signal.metrics.getMetricsAdvisor(
    { projectId },
    { headers: { Authorization: `Bearer ${process.env.SIGNAL_API_KEY}` } },
  );
  ```

  ```python Python theme={"dark"}
  advisor = signal.metrics.get_metrics_advisor(project_id=project_id)
  ```

  ```go Go theme={"dark"}
  advisor, err := client.Metrics.GetMetricsAdvisor(ctx, &projectID)
  if err != nil {
      panic(err)
  }
  ```

  ```ruby Ruby theme={"dark"}
  advisor = signal.metrics.get_metrics_advisor(
    query: { project_id: project_id }
  )
  ```

  ```ruby Rails theme={"dark"}
  advisor = ApolloDeploySignalSdkRails.rails_client.metrics.get_metrics_advisor(
    query: { project_id: project_id }
  )
  ```

  ```php PHP / Laravel theme={"dark"}
  $advisor = $signal->metrics()->getMetricsAdvisor($projectId);
  ```

  ```java Java theme={"dark"}
  var advisor = signal.metrics().getMetricsAdvisor(projectId);
  ```

  ```kotlin Kotlin theme={"dark"}
  val advisor = signal.metrics.getMetricsAdvisor(projectId = projectId)
  ```

  ```csharp .NET theme={"dark"}
  var advisor = await signal.Metrics.GetMetricsAdvisorAsync(
      new Dictionary<string, object?> { ["projectId"] = projectId });
  ```

  ```rust Rust theme={"dark"}
  let advisor = signal.metrics
      .get_metrics_advisor(Some(project_id.to_string()))
      .await?;
  ```

  ```elixir Elixir theme={"dark"}
  query = %ApolloSignal.Types.GetMetricsAdvisorQuery{project_id: project_id}
  {:ok, advisor, _metadata} = ApolloSignal.Client.get_metrics_advisor(client, query)
  ```

  ```swift Swift theme={"dark"}
  let advisor = try await signal.metrics.getMetricsAdvisor(projectId: projectId)
  ```

  ```zig Zig theme={"dark"}
  var metrics = client.metrics();
  var result = try metrics.getMetricsAdvisor(.{ .projectId = project_id }, .{});
  defer result.deinit();

  switch (result) {
      .success => |_| {},
      .api_error => return error.SignalApiError,
  }
  ```
</CodeGroup>