A failure report is not a complaint rate

Answer A DMARC failure report is about an individual message that failed authentication. RFC 9991, edited by S. Jones and A. Vesely and published in May 2026, defines that reporting. It is not a spam-complaint rate. It is not a census of the list. It is a copy of a failure, and copies of other people's mail are a privacy problem before they are a marketing metric.

The note that started this: RFC 9991, DMARC Failure Reporting, S. Jones and A. Vesely, RFC 9991, May 2026.

Aggregate reports, yesterday's subject, summarize. Failure reports, which operators also call forensic reports, point at single messages. The temptation on a solo ad is to treat a folder of those copies as the voice of the list. The folder is not the list. It is whatever a few receivers chose to send back when authentication failed. Safe solo ads sellers do not wave that folder and call it a complaint rate.

The May document updates the older reporting note and replaces the failure-reporting material that lived in the experimental DMARC text. Use this one. A seller quoting the retired document at you in July is quoting last season's instructions. You can say so without opening a second tab. The date on the specification is May 2026. The order in front of you is July.

What is a DMARC failure report?

RFC 9991 defines failure reporting. A failure report is about an individual message that failed DMARC authentication. It is not a count of people who pressed the spam button.

Authentication failure means the message did not satisfy the domain's stated alignment of SPF or DKIM. A person pressing spam means a recipient objected. Those events can overlap. They are not the same event. A forwarded message can fail authentication and still be mail the reader wanted. A perfectly aligned solo can draw complaints because the offer was a stranger. If you add the two numbers together you have invented a third number that neither system produces.

Receivers also do not owe the domain a failure copy of every miss. Many send none. A seller with three failure reports and a list of fifty thousand has not measured fifty thousand outcomes. They have three letters. Ask them not to turn three letters into a percentage on the quote.

• Failure reports are labeled as authentication failures.
• Spam complaints are labeled as complaints.
• A sample is described as a sample, with a count of messages, not a rate invented from silence.
• The quote does not add the two piles together.

Why is a failure report a privacy issue?

It can describe a specific message, not only a daily total. Specific messages can contain addresses and content the recipient did not agree to forward to the domain owner.

This is the part solo buyers skip because it sounds like a lawyer's problem. It is an operator's problem. A failure copy can include a recipient address and a chunk of the message. That person wrote, or received, something. They did not necessarily agree to have it packaged and mailed to the domain that failed the check, which might be the domain of a spoofer, or the domain of a seller who then hands the folder to a buyer. Passing that folder across a sales call is how a private miss becomes a pitch deck.

Ask to see redaction, not the raw copy, if you ask to see anything. A seller who emails you a zip of other people's messages so you will feel safe has shown you the opposite of a careful shop. The careful shop knows why this report is sensitive and keeps the raw file in the shop.

Can a seller use failure reports as the complaint rate on a solo ad?

No. Complaints and authentication failures are different events. Ask for each one by its own name, and do not accept a handful of failure copies as a percentage.

The complaint rate you care about is the one the mailbox provider counts when people mark the mail as spam. That number lives in the provider's tools, for the domain that sent, over a volume large enough to mean something. A failure report lives in a different pipe. Using one as the other is a way to show a flattering sheet.

July 10 is a good day to split the vocabulary on the order form. Aggregate for the machines. Failure copies, if any, under lock, and never as a rate. Complaints by their own name. Clicks by their own name. A solo ad that needs four words is a solo ad you can audit. A solo ad that uses one word for all four is a story.