DMARC ruf= Tag: Forensic Report URI (ruf)
The DMARC ruf tag specifies where to send forensic (failure) reports, which contain redacted copies of individual failing messages. Privacy concerns limit receiver support.
Published · Last verified · Maintained by TamingDNS
✅ Valid Values
💬 What This Tag Does
The "ruf" tag requests forensic reports (also called failure reports), individual per-message reports sent when a message fails DMARC. Unlike aggregate reports, these contain message details and can help diagnose specific failures. However, privacy concerns mean most major ISPs (Google, Microsoft, Yahoo) no longer send forensic reports, limiting their practical value.
📋 Complete Example Records
Every one of these is a complete record you can paste as it stands. Each goes in a TXT record at
_dmarc.yourdomain.com. Check yours with the
DMARC Checker
or assemble one in the
DMARC Builder.
v=DMARC1; p=none; rua=mailto:dmarc-feedback@example.com; ruf=mailto:auth-reports@example.com
RFC 9989 Appendix B.2.2 uses this pair. Aggregate reports give the overall picture, and failure reports help with the intermittent problem you cannot reproduce.
v=DMARC1; p=none; rua=mailto:dmarc-feedback@example.com; ruf=mailto:auth-reports@thirdparty.example.net
Failure reports sent outside your own domain. Receivers that honour the request MUST first check the third party authorises it.
v=DMARC1; p=reject; ruf=mailto:auth-reports@example.com; fo=1
The "fo" tag only means anything alongside "ruf". Here it asks for a report whenever either SPF or DKIM fails to produce an aligned pass.
v=DMARC1; p=reject; rua=mailto:dmarc-feedback@example.com
Leaving "ruf" out is the common choice. Failure reports carry message content, and the large receivers largely stopped sending them on privacy grounds.
📚 RFC References
🔗 Related DMARC Tags
🛡️ Related Tools
Analyse your current DMARC record, build a new one, or read the aggregate reports that tell you whether the policy is safe to tighten.