RFC 9991 — DMARC failure reporting

RFC 9991 defines DMARC failure reports — the per-message detail requested by the ruf= tag, sometimes called forensic reports. It was split out of RFC 7489 alongside RFC 9989 and RFC 9990.

What a failure report is for

Two jobs, in the RFC’s framing. It helps you “determine the cause of failures that were part of aggregate reports” — an aggregate report tells you that mail failed and roughly from where, while a failure report tells you about one specific message. And it lets a domain owner “quickly identify and address harmful messages involving direct domain abuse”.

The format derives from the Abuse Reporting Format (RFC 6591), which RFC 9991 augments with DMARC-specific fields:

Field
Identity-Alignment	required — which mechanisms failed to authenticate an aligned identity, or none
DKIM-Domain, DKIM-Identity, DKIM-Selector	required for DKIM failures of an aligned identifier
SPF-DNS	required for SPF failure of an aligned identifier
Delivery-Result	optional
DKIM-Canonicalized-Header / -Body	optional

Note DKIM-Selector is required here too — the same change RFC 9990 made to aggregate reports. Knowing which selector failed is the difference between an actionable report and a shrug.

Why you will receive almost none of these

This is the part worth knowing before you add ruf= to a record and wait.

A failure report can contain the header fields, and sometimes the entire content, of a real message — which means Personally Identifiable Information belonging to a third party. The RFC is direct about the consequences: the potential disclosure of PII “should be considered when deciding whether to request failure reports as a Domain Owner, or what information to include or redact in failure reports when creating them as a Mail Receiver, or whether to create failure reports at all.”

In practice the major mailbox providers made that last call years ago. You can publish ruf= correctly and receive nothing indefinitely — not because your record is wrong, but because almost nobody generates them.

What it means in practice

Publish rua= and rely on aggregate reports. They come from nearly everyone, they carry no PII, and they answer the questions you actually have.

Add ruf= only if you have somewhere to put reports that may contain other people’s mail, and treat anything that arrives as a bonus. If you do, the fo= tag controls when a report is generated — that one is defined in RFC 9989, not here.

Read it: rfc-editor.org/rfc/rfc9991