What Is a DMARC ri Tag?

The DMARC ri tag, short for report interval, defines how often domain owners want to receive aggregate DMARC reports from receiving mail servers. It specifies the desired interval in seconds, with the default value being 86,400 seconds (equivalent to 24 hours).

The ri tag is optional in a DMARC record but can help control the frequency of incoming reports, especially for large organizations handling significant email volumes.

Example DMARC record with ri:

This tells receiving servers to send aggregate reports every 24 hours to dmarc@yourdomain.com.

How the DMARC ri Tag Works

When a receiving mail server processes emails from your domain, it aggregates authentication results (SPF, DKIM, and DMARC outcomes) into XML reports. These reports are then sent to the address specified in your rua tag, usually once per day.

The ri tag informs those servers of your preferred reporting frequency. While 86,400 seconds (1 day) is the standard, you can set it to:

• 12 hours: ri=43200
• 6 hours: ri=21600
• 2 days: ri=172800

It’s important to note that mail receivers are not required to honor your interval request. Some providers, such as Google or Microsoft, always send reports daily regardless of the ri value. The tag simply communicates your preference.

Why the Report Interval Matters

Adjusting the DMARC report interval helps balance visibility and data volume:

• Shorter intervals (e.g., every 6 hours) provide faster insight into configuration changes or authentication failures.
• Longer intervals reduce the number of incoming reports but can delay detection of spoofing attempts or misconfigurations.

For organizations with many sending sources, keeping the default 24-hour interval usually provides a manageable balance between data frequency and report volume.

When first deploying DMARC, shorter intervals can be helpful for close monitoring, but once policies are stable, daily or multi-day reports are sufficient.

DMARC ri and DMARCeye

DMARCeye automatically processes aggregate reports regardless of their delivery interval. Whether your ri value is 12 hours or 48 hours, DMARCeye consolidates all reports into a unified dashboard, summarizing authentication outcomes, source activity, and trends.

By centralizing this data, DMARCeye makes the ri tag’s timing less critical: you get continuous visibility into your domain’s authentication performance without manually handling multiple XML files or managing report timing.

Sign up for a free trial of DMARCeye today and secure your email domain.

To learn more about DMARC and DMARC-related terms, explore the DMARCeye Glossary.