What aggregate reports contain

A DMARC aggregate report is an XML document a receiving mail server sends roughly daily, summarizing every message it saw claiming to be from your domain during that window, grouped by source IP. Each row (this tool stores it as one report_records row) carries a message count, the disposition applied (none/quarantine/reject), and the raw SPF/DKIM authentication results.

Reports contain no message content, subject lines, or recipient addresses — only sender IPs and authentication outcomes. Most reporting IPs are mail servers operated by organizations rather than individuals, though a residual subset (self-hosters, compromised residential hosts) can be personal data; this tool's retention and enrichment code treats that distinction deliberately rather than assuming either way.