Where does the Deliverability data come from?

From DMARC aggregate (rua) reports. Every mailbox provider that receives mail claiming to be from your domain files a machine-readable report — usually once a day — listing how many messages passed or failed SPF and DKIM alignment and the IPs they came from. Folio diverts those reports out of your inbox, parses them, and charts the rollup at /app/deliverability.

Why don't I see anything yet?

Aggregate reports arrive about once a day per provider, so a freshly bound domain has nothing to show until the first report lands — usually within 24 hours. The page reads reports for domains whose _dmarc record publishes a rua= address pointing at Folio, which new domains do automatically.

How do I monitor a domain I added before this shipped?

Add rua=mailto:dmarc-rua@ to that domain's existing _dmarc TXT record. Folio already accepts the address (the receive-only alias is created for you), so that one line is the only change. The exact record is on the domain's detail page.

When should I tighten my DMARC policy?

Once the page shows a clean pass rate across a full window for a domain, it surfaces a 'Ready to tighten' note. At that point you can move the domain's policy from p=none toward p=quarantine, then later p=reject, so spoofed mail is held or rejected instead of merely logged.

Reading your DMARC reports

The Deliverability page at /app/deliverability reads the daily DMARC aggregate reports that mailbox providers send for your domains and rolls them up per domain: the authentication pass rate, a daily pass/fail series, the source IPs sending as you and failing, and which providers reported. Reports are diverted out of your inbox to a receive-only dmarc-rua@alias Folio manages for you. New domains are wired automatically; expect about a day for the first report to land.

Every mailbox provider that receives mail under your domains files a daily report on who passed authentication — and who is forging you. Folio reads them so you don't have to.

Jun 2026· Updated 2026-06-16·5 min read

Once your DMARC record is live, mailbox providers start sending aggregate reports — a daily, machine-readable tally of every message that claimed to be from your domain, whether it passed SPF and DKIM alignment, and which IP it came from. The raw reports are gzipped XML; left alone they pile up as opaque attachments. Folio diverts them out of your inbox, parses them, and charts the result.

§ Where the data comes from

Each domain you bind publishes rua=mailto:dmarc-rua@<your-domain> in its _dmarc record. That address is a receive-only alias Folio creates and manages for you the moment you add the domain — it never lands in your inbox, never appears as a sendable identity, and you don't create it yourself. Reports addressed to it are accepted, parsed, and rolled up at /app/deliverability.

Aside

Reports arrive roughly once a day, per provider. A domain you bound this morning won't show anything until the first report lands — usually within 24 hours. An empty page is the normal early state, not an error.

§ What the page shows

Each domain you're monitoring gets its own panel:

·DMARC pass rate — the share of reported messages that passed authentication across the window.
·Daily authentication — a bar per day, with the failed share stacked above the passed share, so a bad day stands out at a glance.
·Failing sources — the IP addresses sending mail as you and failing, ranked by volume. A clean domain reads “Nothing sending as you has failed.”
·Reported by — the providers (Google, Microsoft, Yahoo, and the rest) that filed reports in the window.

§ Tightening the policy

A new domain should start at p=none — monitor only. Spoofers are logged but nothing is held, so legitimate mail you forgot about (a newsletter tool, a ticketing system) can't be silently dropped while you're still learning who sends as you. Once a domain shows a clean pass rate across a full window, the page surfaces a Ready to tighten note. Then move the policy up a rung at a time:

01p=none — reports only. Confirm every legitimate sender is passing.
02p=quarantine — failing mail goes to the recipient's spam folder. Watch the pass rate hold for a week.
03p=reject — failing mail is refused outright. The strongest protection; move here once quarantine has been clean.

Edit the p= value in your domain's _dmarc TXT record at your registrar; nothing changes on Folio's side.

§ Bringing in an older domain

Domains added before per-domain reporting shipped send their reports elsewhere and won't appear here until you opt in. The change is one line: add rua=mailto:dmarc-rua@<your-domain> to that domain's existing _dmarc record. Folio already accepts the address, so no other record — and no alias of your own — is needed. The exact value is on the domain's detail page.

§ Common questions

Where does the Deliverability data come from?: From DMARC aggregate (rua) reports. Every mailbox provider that receives mail claiming to be from your domain files a machine-readable report — usually once a day — listing how many messages passed or failed SPF and DKIM alignment and the IPs they came from. Folio diverts those reports out of your inbox, parses them, and charts the rollup at /app/deliverability.
Why don't I see anything yet?: Aggregate reports arrive about once a day per provider, so a freshly bound domain has nothing to show until the first report lands — usually within 24 hours. The page reads reports for domains whose _dmarc record publishes a rua= address pointing at Folio, which new domains do automatically.
How do I monitor a domain I added before this shipped?: Add rua=mailto:dmarc-rua@to that domain's existing _dmarc TXT record. Folio already accepts the address (the receive-only alias is created for you), so that one line is the only change. The exact record is on the domain's detail page.
When should I tighten my DMARC policy?: Once the page shows a clean pass rate across a full window for a domain, it surfaces a 'Ready to tighten' note. At that point you can move the domain's policy from p=none toward p=quarantine, then later p=reject, so spoofed mail is held or rejected instead of merely logged.