What is a DMARC report and do I need to read them?

A DMARC report is a machine-generated summary receiving mail providers send back to you - every server that sent email claiming to be from your domain, and whether those messages passed your SPF and DKIM checks. The practical points:

• How you get them - add a rua= tag (plus an address to receive them) to your DMARC record, and the big providers start sending reports daily.
• What they look like - compressed XML, unreadable by hand in any volume, which is why most businesses run them through a free or low-cost report viewer.
• A free option - if your domain’s DNS is on Cloudflare, its free DMARC Management service collects the reports to an address it provides and turns the XML into a readable dashboard at no cost.
• What they answer - the 2 questions you cannot answer any other way: is anyone spoofing my domain right now, and would tightening my DMARC policy block any legitimate mail I forgot about?

Collect the reports before you enforce - they are how you tighten DMARC without bouncing your own invoices.