Aggregate Performance Reporting (APRF)

1. What APRF is

APRF (Aggregate Performance Reporting) is an emerging email reporting standard, currently an IETF draft. It lets participating mailbox providers send daily aggregate reports directly to domain owners.

DMARC aggregate reports tell you whether your mail authenticated and what your policy did about it. APRF reports something different — what happened after delivery:

• Placement — whether messages were delivered to the inbox or to the spam folder.
• Recipient engagement — aggregated signals of how recipients acted on your mail.

Comcast / Xfinity is currently the only mailbox provider sending APRF reports. Figures therefore cover mail delivered to Comcast and Xfinity addresses, not your deliverability overall. Other providers will appear automatically as they adopt the standard, with no changes needed on your side.

Specification: draft-brotman-aggregate-performance-reporting

How it works

1. Discovery. Mailbox providers read the signing domain (d=) and selector (s=) from the DKIM signature on your mail, and look up the APRF record at <selector>._aprf._domainkey.<signing domain>.
2. Daily reporting. Once a day, the provider sends a JSON report covering one signing domain and selector, containing placement counts and engagement counts.
3. Privacy bands. Volumes are rounded up into bands to protect recipient privacy. Comcast's smallest band is 100, with 1,000 and 10,000 bands also in use — so 118 messages is reported as 200. A reported 0 is always exact.
4. Ingestion. EasyDMARC receives the reports, parses them, matches each one to a sending source, and presents the results in Sender Insights.

2. Managed APRF

DMARC → Managed Solutions → Managed APRF

Managed APRF sets up and maintains the APRF record for a domain.

How it differs from Managed DKIM

Activating

Option A — Managed DKIM already active

If the domain is already delegated to EasyDMARC through Managed DKIM, no DNS changes are needed. Select Activate Managed APRF, and EasyDMARC publishes the record in the hosted zone for you.

Option B — publishing the record yourself

1. Select Activate Managed APRF to open the setup panel.
2. Log in to your DNS provider.
3. Add the TXT record shown below.
4. Return to EasyDMARC and select Verify.

DNS changes can take a few hours to take effect. EasyDMARC also re-checks in the background, so you don't have to return and verify manually.

Status lifecycle

A gap in reports does not always mean a problem with your setup. Providers send on their own schedule, and may not report on days when there is little or no mail.

3. APRF tools

Tools → APRF

Two standalone tools for generating and diagnosing records, available with or without an account.

APRF Record Checker

Inspects the live APRF setup for any domain.

Inputs

• DKIM signing domain. The domain in your DKIM signature (the d= value). This is often not the same as your From domain.
• Selector (optional). Enter one selector, or leave empty to check the selectors we can find plus any wildcard record.

What it checks

• Resolves <selector>._aprf._domainkey.<domain> and the wildcard equivalent.
• Follows CNAMEs through to the final TXT record.
• Validates the version tag, the reporting address, and the optional segmentation tag.
• Checks whether the domain receiving your reports is authorised to accept them, when it differs from your signing domain.

Results

A separate warning appears when the reporting address sits on a different domain and we can't confirm that domain has authorised it. The record itself remains valid — some providers check this before sending, so reports may not arrive until it is published.

APRF Record Generator

Builds a record for you to publish.

Inputs

• DKIM signing domain. The domain used in your outgoing DKIM signatures.
• Selector (optional). Leave empty for a wildcard record covering every selector on the domain.
• Send reports to. Inside the platform this is prefilled with your EasyDMARC reporting address, so reports reach your dashboard. You can add further addresses to receive a copy yourself.

Output

Host: *._aprf._domainkey.yourdomain.com

Type: TXT

Value: v=APRFv1; rua=mailto:<your EasyDMARC reporting address>

4. Sender Insights — Aggregate Performance Reports

Sender Insights → Post-send → APRF Rep

Reading the numbers

• Volumes. Providers report in bands and round up, so counts may shown with a tilde (~) and indicate scale rather than exact figures.
• A reported zero is exact. "No mail reached the inbox" and "no negative actions" are reliable statements at any volume.
• Percentages need volume. Rates are shown only where reported volume reaches 1,000 in the selected range. Below that, counts are shown instead.
• Engagement is counted in actions, not messages. One recipient can produce more than one action, and an action may relate to a message received before the selected period — so engagement is never shown as a share of messages.

Widgets

Charts

Placement breakdown

The split between inbox and spam folder, with sending sources listed alongside. The list can be sorted by inbox rate, spam rate or volume.

Engagement

Recipient actions reported by the provider. The standard groups them into categories rather than reporting each action, and each provider decides what belongs in each category. The examples the standard gives are:

Comcast does not currently send the neutral category, so it will not appear in your reports today.

Inbox placement trend

Inbox placement rate over time, with daily, weekly and monthly views. A gap means no report was received for that point, not that nothing reached the inbox.

Reporting sources table

One row per domain. Expanding a row shows the sending sources found inside that domain's reports. Counts are summed from the child rows; percentages are recalculated from those summed counts rather than averaged.

Placement percentages are a share of that row's volume. Engagement percentages are a share of that row's engagement actions. The two use different denominators.

5. Frequently asked questions

Which mailbox providers support APRF today?

Comcast and Xfinity, and it is a beta. Google co-authored the draft and the authors have reported interest from other providers, but no others are sending reports yet. As they adopt the standard, their reports will appear in your dashboard with no DNS changes needed.

Why does a sending source show "Not eligible"?

Because it signs your mail with the sending provider's own domain rather than yours, which means the APRF record would have to be published in their DNS. Configuring custom DKIM at that provider, so mail is signed with your domain, makes the source eligible.

Why are volumes shown with a tilde?

Providers round volumes up into bands to protect recipient privacy — anything from 1 to 100 messages may be reported as 100. The tilde marks a figure as approximate. A reported zero is exact.

Do I need a separate record for each selector?

No. A single wildcard record covers every selector on the domain, including any added later.

Which domain do I use — my From domain or my signing domain?

Your DKIM signing domain, the d= value in your DKIM signature. It is often a subdomain of your main domain, and sometimes your sending platform's own domain.

Does publishing an APRF record affect my mail delivery?

No. Providers that don't support APRF simply ignore the record. It has no effect on authentication or delivery.

Is APRF a finished standard?

No. It is an IETF draft, not yet adopted by a working group, and details may change. The one live implementation is a beta.