RUF (Reporting URI for Forensic) is the DMARC field specifying where receivers should send per-message forensic failure reports. Each RUF report contains headers, body extracts, and authentication results for a single message that failed DMARC.
Record Format
_dmarc.example.com. TXT "v=DMARC1; p=none; rua=mailto:rua@example.com; ruf=mailto:ruf@example.com;"Why It’s Rarely Used
Most large receivers — Gmail, Yahoo, Outlook — don’t send RUF reports at all, citing privacy regulations. RUF reports contain end-user email content, which is protected personal data under GDPR and similar frameworks.
When It Does Fire
Some smaller providers (Mail.ru, Yandex) send RUF, and self-hosted enterprises may generate them for incident-response workflows.
Alternative
Skip RUF and rely on RUA aggregate reports for pattern detection, plus your own SIEM logs for message-level forensics.
Related
Read what DMARC is, check the RUA glossary entry, and learn how to read a DMARC report.