Volume discrepancies

"I sent X number of messages, but reporting indicates Y number - why?"

There are a few possible explanations.

The first consideration is a false problem: you are expecting to see data too soon. DMARC data reports are intended to cover a complete 24 hour day period. For worldwide interoperability this 24 hour window is very strongly encouraged (to reporters, by the RFC) to be stable across the UTC midnight-midnight timeframe (i.e. 00:00:00 to 23:59:59 UTC). However even for reliable providers who adhere to this standard, collating the data and sending literally millions of extra messages (DMARC reports) every day can take some time. This lag can vary from an hour after UTC midnight to 12 hours (or more sometimes) later.  The takeaway here is: you should not expect a complete picture of reporting data until sometime the day *after* those messages were sent.

The most likely real issue:

A) seeing fewer than expected

Not all environments support DMARC (even some larger ones, e.g. Proofpoint, Messagelabs, Netease), so any portion of volume that you sent to recipients at those environments is not reported, so cannot be counted.  You can always check dmarcian's reporter page to review who has participated in the past 7 days.

If you are a customer of one of these environments, we strongly encourage you to contact your support there and request that they support this critical open standard. These environments benefit enormously from the work that domain owners put in to ensure more authenticity in their email messages, so they should both support the requested domain policies and provide the feedback reports that are defined in the RFC.

B) Seeing more than expected

This can occur because the sending environment (usually an ESP or managed email sending platform) is consolidating many recipients into 1 reported message, resulting in a few of (for example) 5 messages in their reporting, but 100 messages reported seen at DMARC reporters. To check if this is an issue in your case, you would need to consult with your sending vendor.

Another reason that this can occur is if some of the target recipients of your messaging are email lists: this could result in a significant bifurcation to more recipients.


Another consideration: when did you begin DMARC reporting to your dmarcian account? If it was recently (last 2/3 days), it is possible that the larger data providers have not yet begun sending reports for your domain(s).

A less likely, less common scenario:

If you have configured your reports to go to a different address than directly to your dmarcian reporting address, it may be that some reports are being lost at the forwarder.  We cannot diagnose that, so it would be completely up to you to attempt to determine whether this is an issue.  We can only suggest that you update your DMARC record to explicitly include your account here.

https://us.dmarcian.com/dmarc-data-providers/