DMARC reports
Updated on 2026-10-23
Google, Microsoft en andere ontvangers melden elke dag welke mail als uw domein verstuurd werd, en of die slaagde. HairConnect leest die rapporten en zet op uw startscherm wat faalt. (Google, Microsoft and other receivers report every day which mail was sent as your domain, and whether it passed. HairConnect reads those reports and puts what fails on your home screen.)
Instellingen → Koppelingen → Communicatie → DMARC-rapporten → Instellen (Settings → Integrations → Communication → DMARC reports → Configure). Only the owner can do this.
What it is
The DNS of your domain holds a DMARC record (at _dmarc.yourdomain.be). It contains an address after rua=. The big mail providers send a report to that address every day: which servers sent mail with your domain as the sender, how much, and whether that mail passed DKIM and SPF. The reports arrive as zipped XML attachments, and without help nobody reads them.
This integration reads them for you. A report can show two kinds of problems:
- one of your own services failing — for example a mail server whose DKIM key is not in your DNS. That mail can end up in your customers' spam;
- an unknown source sending mail as if it came from you.
Turning it on
- Press Instellen (Configure) and fill in Uw maildomein (your mail domain): the part after the @ of the address your salon mails from.
- Save and switch the integration on. Your salon gets its own address for the reports, of the form
info+dmarc-…@hairconnect.be. It is shown in the Instellen (Configure) window. - Choose how the reports reach that address: route A or route B below. If you do both, every report arrives twice; HairConnect counts it once.
Route A: changing the DMARC record
The Instellen (Configure) window shows the full record, with your address and the HairConnect address in it.
| What | Who | Where |
|---|---|---|
Replace the TXT record at _dmarc.yourdomain.be with the record from the window |
whoever manages your DNS: the company where your domain is registered, or whoever does it for you | the DNS of your domain |
The authorisation record yourdomain.be._report._dmarc.hairconnect.be with the value v=DMARC1 |
HairConnect | the DNS of hairconnect.be |
The address that was already after rua= stays in: the reports then arrive in both places. The policy (p=) does not change.
The authorisation record is required (RFC 7489, §7.1): a provider only sends a report to an address outside your domain if that other domain confirms it wants the reports. You do not have to do anything for it.
Then press Controleer DNS (check DNS). It reads both records and says which one is still missing. Nothing is changed anywhere.
Route B: forwarding with a Gmail filter
No DNS needed. You do this in the mailbox where the reports arrive now.
- Gmail → Settings → See all settings → Forwarding and POP/IMAP → Add a forwarding address, and enter the address for the reports.
- Gmail sends a mail with a confirmation code to that address. Within a few minutes it shows on the DMARC-rapporten (DMARC reports) screen, under Post zonder rapport (mail without a report). Copy the code into Gmail.
- Create a filter on the subject
Report domain: yourdomain.beand have it forward to the address for the reports. RFC 7489 prescribes that subject. After a day, check whether reports came in; if not, filter on the sender of the reports in your mailbox.
The DMARC reports screen
Instellingen → DMARC-rapporten (Settings → DMARC reports). It is there as long as the integration is on. At the top you see where things stand, below that Wat faalt (what fails), the reports received and the mail without a report.
Every source in a report gets a verdict:
| Verdict | What it means |
|---|---|
| In orde (OK) | DKIM or SPF passed, and belongs to your domain. |
| Eigen bron faalt: instelling klopt niet (own source fails: a setting is wrong) | The source is in your domain's SPF record (for example Google Workspace or the HairConnect mail server), but its mail does not pass. Usually that service's DKIM key is missing from your DNS. |
| Onbekende bron: mogelijk misbruik (unknown source: possible abuse) | The source is not in your SPF record and sends mail as your domain. That can be abuse, or a service forwarding your mail, such as a forwarding rule at a recipient or a mailing list. |
| Gefaald, bron niet na te gaan (failed, source cannot be checked) | The mail did not pass, and your domain's SPF record could not be read at that moment. |
Everything except In orde (OK) is red. Whether a source is your own, HairConnect takes from your domain's SPF record as it stood in the DNS at that moment.
The notice on the home screen
As long as there is a red row that nobody has checked, the owner's home screen shows a block Er faalt mail die als … verstuurd wordt (mail sent as … is failing), with a button to the screen. Staff members do not see it. No email and no text message is sent.
On the screen, Als nagekeken markeren (mark as checked) marks the red rows as checked: the block disappears. The rows stay red in the reports. When a new report with a red row arrives, the block is back.
Advice: making the policy stricter
If all mail has passed for thirty days, reports are still coming in and your policy is p=none, the screen suggests setting p=quarantine: mail that fails then lands in the recipient's spam. It is only a suggestion. HairConnect does not change your DNS; whoever manages your DNS changes the record. Only do it when every service that mails as you is green.
What is refused
- A report about a domain other than the one configured.
- An attachment larger than 10 MB once unpacked, a zip with more than one file or with a password, and a file that is not XML.
- An XML file with a DTD. A DMARC report does not need one.
What is refused is listed under Post zonder rapport (mail without a report), with the reason. When the integration is off, nothing is stored.