AFRF

AFRF is the Acronym for Authentication Failure Reporting Format

The standardized message format used to generate RUF (Forensic/Failure) reports. It defines a uniform way for email receivers to package and send details about an email that failed DMARC authentication back to the domain owner.

By using a consistent structure, AFRF allows automated tools to parse the reasons for failure without human intervention.

Key Components of an AFRF Report

Feedback Type: Usually labeled as auth-failure, identifying the nature of the report.
Authentication Results: Displays the specific status of SPF, DKIM, and DMARC (e.g., pass, fail, or softfail).
Original Mail Headers: Includes the headers from the message that failed, such as From:, To:, Subject:, and Message-ID:.
Reporting MTA: Identifies the mail server that generated the failure report.
Source IP: The IP address of the server that attempted to send the original, failed message.

Why AFRF Matters

Interoperability: Because it is a standard (defined in RFC 6591), different mailbox providers like Yahoo or specialized security gateways can send reports that any DMARC analysis platform can understand.
Incident Response: Security teams use the data in AFRF reports to identify the specific lures used in phishing campaigns, such as the URLs or attachments included in the failed email.
Redaction Support: The format allows recipients to redact sensitive information from the email body while still providing the technical headers needed for troubleshooting.

Example of AFRF Data Fields

An AFRF report is typically sent as a multipart email. The second part of that email contains the machine-readable fields:

Feedback-Type: auth-failure
User-Agent: Responder-MTA
Version: 1
Original-Mail-From: spoofed-sender@example.com
Arrival-Date: Tue, 10 Mar 2026 09:15:00 +0000
Source-IP: 192.0.2.1
Authentication-Results: dmarc=fail header.from=example.com

Summary Table: AFRF vs. XML (RUA)

Feature	AFRF (Failure)	XML (Aggregate)
Associated Tag	RUF	RUA
Readability	Human and machine-readable	Primarily machine-readable
Content	Header and metadata of one email	Statistical summary of thousands
Standard	RFC 6591	RFC 7489