Medium SeverityDMARC

Fix: DMARC Reporting (rua) Not Configured

Q: Can I send DMARC reports to multiple addresses?

Yes. Separate multiple addresses with commas: rua=mailto:dmarc@yourdomain.com,mailto:dmarc@thirdparty.com

Your DMARC record does not include a rua (aggregate reporting) tag. Without it, you will not receive any reports about email authentication results for your domain.

Quick Fix

Add `rua=mailto:[email protected]` to your DMARC record.

What This Error Means

The rua tag in a DMARC record specifies where receivers should send aggregate reports. Without it, you have no visibility into who is sending email as your domain or whether authentication is passing.

Why It Matters

DMARC reports are essential for understanding your email ecosystem. Without them, you cannot see legitimate senders that might be failing authentication, detect spoofing attempts, or safely upgrade your DMARC policy.

Step-by-Step Fix

Choose a reporting email address

Pick an email address that will receive the DMARC aggregate reports. These are XML files sent daily by receiving mail servers.

Add the rua tag to your DMARC record

Update your existing DMARC TXT record to include the rua tag.

Before

v=DMARC1; p=quarantine

After

v=DMARC1; p=quarantine; rua=mailto:[email protected]

Consider a DMARC report processor

Raw DMARC reports are XML and difficult to read. Services like Postmark DMARC, dmarcian, or EasyDMARC can parse them into readable dashboards.

Verify reports are arriving

After updating the record, wait 24-48 hours for the first reports to arrive.

Example

dig +short TXT _dmarc.yourdomain.com
# Confirm rua is present in the record

Common Gotchas

If the rua address is on a different domain, the receiving domain must publish an authorization record at yourdomain.com._report._dmarc.otherdomain.com.
DMARC aggregate reports can be voluminous for high-traffic domains. Make sure the receiving mailbox can handle the volume.
The ruf tag (forensic reports) provides per-message failure details but many receivers do not send them due to privacy concerns.

Verify Your Fix

After making changes, use our free scanner to verify the fix is working correctly. DNS changes can take up to 48 hours to propagate, but most propagate within minutes.

Frequently Asked Questions

What format are DMARC aggregate reports in?

DMARC aggregate reports are XML files, usually compressed as .zip or .gz. A report processor can convert these into human-readable dashboards.

Can I send DMARC reports to multiple addresses?

Yes. Separate multiple addresses with commas: rua=mailto:[email protected],mailto:[email protected]

How often are DMARC reports sent?

By default, aggregate reports are sent daily (every 86400 seconds). You can adjust this with the ri= tag, but most receivers only send daily regardless.