Glossary
DMARC ruf= Tag — Forensic Failure Reports
The ruf= tag in a DMARC record specifies where forensic (failure) reports are sent. Unlike aggregate reports (rua=) which are daily summaries, forensic reports are sent per-message when an email fails DMARC. They contain message-level detail including headers and sometimes message content. Most senders skip ruf= due to privacy concerns and low receiver support.
ruf= vs rua=
- rua= — daily aggregate, always implement
- ruf= — per-failure, privacy-sensitive, optional
Why Most Senders Skip ruf=
Many major providers (Gmail, Yahoo) don't send forensic reports due to privacy concerns. The per-message detail can expose user data. Most organizations get sufficient visibility from rua= alone.
FAQ
What is the ruf= tag in DMARC?
The email address for per-message forensic failure reports. Unlike rua= aggregate reports, ruf= sends a report for each individual DMARC failure.
Should I add ruf= to my DMARC record?
Most senders don't need it. rua= aggregate reports give sufficient visibility. ruf= is privacy-sensitive and many major providers don't send them anyway.
Do Gmail and Yahoo send ruf= reports?
No. Most major providers don't send forensic reports due to privacy concerns. Only implement ruf= if you have a specific compliance requirement for it.