rua= (aggregate) reports are daily summaries showing message counts, source IPs, and pass/fail results in aggregate. They contain no email content. ruf= (forensic/failure) reports are near-real-time messages sent when individual emails fail — they may contain message headers and sometimes body excerpts. Most organizations use rua only: it gives full visibility without privacy exposure. ruf reports are rarely sent by major providers (Google and Outlook have largely stopped sending them) and some privacy regulations restrict using them.
All questions