RFC 9991 Fields in DMARC Failure Reports

RFC 9991, published in May 2026 as part of the standards, adds a set of authentication fields to DMARC failure reports. Those fields are now readable in both human-format views of the Forensics tab, so you no longer need to drop into RAW mode to see them. The RAW views themselves are unchanged and continue to show each report exactly as received. What's new: The failure report's own fields now appear in readable form for the first time: Feedback-Type, Version, User-Agent, Auth-Failure, Reported-Domain, Source-IP, Original-Mail-From, Original-Envelope-Id, Arrival-Date, Incidents, Delivery-Result and Authentication-Results, each as a separate field DKIM-Domain, DKIM-Identity, DKIM-Selector and SPF-DNS are shown where the reporting receiver supplies them Identity-Alignment is shown in the mail headers view alongside your existing SPF Alignment and DKIM Alignment values, so you get the RFC-standard label without losing the plain Yes and No you already read at a glance The To field now displays cleanly, without escaped quote characters or a stray carriage-return escape Nothing about how SPF Alignment, DKIM Alignment or DMARC Result is calculated has changed. These are existing values, displayed as produced. Two things worth knowing. First, very few reporting providers emit the new RFC 9991 fields yet, so expect to see them rarely for a while. Where a field is absent we simply omit it. Second, a failure report is not automatically a problem: your hosted record requests reports for DKIM or SPF failures even where DMARC passed overall, and a report showing only one mechanism unaligned is almost always forwarding or a gateway modifying the message, not spoofing.