An aggregate report is visibility, not a click

Answer An aggregate report is visibility for the domain owner. RFC 9990, by A. Brotman, published in May 2026, defines DMARC aggregate reporting. The reports show which IP addresses sent mail using the domain and how SPF and DKIM turned out. They are not a click count, and they are not a solo ad price.

The note that started this: RFC 9990, DMARC Aggregate Reporting, A. Brotman, RFC 9990, May 2026.

May rewrote the reporting documents. July is a good month to use the new one and ignore the habit of quoting the experimental text as if it were still the instruction sheet. If you buy solo ads, the report you want is the one for the domain that will sign your send. A seller who has never opened it is guessing about who else sends as that name.

The aggregate report is the rua stream. Receivers that support it send XML on a schedule, summarizing messages that used the domain. You see sources. You see authentication results. You do not see the creative, and you do not see whether anyone was glad. That limit is the point. The tool answers a narrow question well. Sellers get in trouble when they stretch it into a traffic story.

What does a DMARC aggregate report show?

RFC 9990 defines the aggregate report. It shows IP addresses that sent mail using the domain and the SPF and DKIM results receivers saw. It is visibility for the domain owner.

Read it as a list of machines. Some of those machines will be the platform in the quote. Some may be a forwarding service, a security gateway, or a tool nobody remembers buying. The first time a seller looks, the surprise is usually an IP they cannot name. That surprise is worth more than a polished open rate. An unnamed IP sending as the domain is either a vendor they forgot or a problem.

The May 2026 document replaces the reporting material in the older experimental DMARC text. Use the current document when you talk about what a report contains. A slide that says compliant with the retired document is a slide about a text that May already moved past. You do not need a second link to know which year to trust. Trust the year on the report specification you are actually reading.

• The domain in the report is the domain that will sign the solo.
• The IPs in the quote match IPs the seller can name in the report.
• An unnamed IP is explained before the send, or the send waits.
• The report is not pasted into the order as a revenue figure.

Is an aggregate report a measure of solo ad sales?

No. The report does not contain clicks, revenue, or a price. A domain with clean authentication can still be mailing people who did not ask for the offer.

Authentication answers whether the domain's policy and the signatures line up. It does not answer whether the list opted in, whether the offer matches the list, or whether the click was a person. A perfect report on a dirty list is a well-documented mistake. Pay for the list quality separately, with questions a report cannot answer.

One tag in particular confuses people who copy sample records from blogs. The pct tag was made historic in May 2026. A sample that still prints pct equals 100 is copying an old habit. It is not enforcement, and it is not a dial you turn to send a solo ad to a fraction of the internet. If a seller's screenshot leans on that tag, ask them what the current document says to do instead. If they cannot say, they are decorating.

What should a buyer ask to see before paying?

Ask for a recent aggregate report on the domain that will sign the send, and ask the seller to point at the IPs that belong to the platform in the quote. A report they cannot open is a report they do not use.

You are not asking them to forward a stranger's mail. Aggregate reports can contain operational detail. A redacted page that shows the date, the domain, and the IPs they claim are theirs is enough. A refusal to show even that, from a seller who claims the domain is clean, is the answer. Clean is a claim. The report is the check.

Keep the check in its lane. Visibility stops impersonation from being invisible. It does not write the offer, and it does not price the drop. July's job is to look at the machines. The click still has to be earned on the page.