Fix Missing DMARC rua Reporting Address

What's happening

The rua= tag in a DMARC record specifies one or more email addresses where receivers should send aggregate reports — daily XML files summarizing authentication results for every message claiming to come from your domain. Without rua=, receivers still enforce the policy but you have zero visibility into what is happening.

Aggregate reports are the only first-party signal you have into authentication failures. They show every IP that sent as your domain, the SPF and DKIM result for each, alignment status, and the disposition (delivered, quarantined, rejected). Without them, advancing from p=none to p=reject is operational guesswork.

Every major receiver supports rua=. Google, Microsoft, Yahoo, Mail.ru, and most ESPs send daily reports for any domain that requests them. The reports are XML files attached to email messages — typically zipped, with filenames like google.com!example.com!1746748800!1746835200.xml.gz.

Why it matters

Without rua=, DMARC enforcement is risky. Legitimate senders that fail alignment go undetected until enforcement bounces their mail and customers complain. Recovery requires investigation without telemetry — significantly slower than reading a report.

Brand-impersonation campaigns are invisible. Spoofers send millions of messages as your domain and you never know until customers report phishing. Aggregate reports surface this within 24 hours.

Compliance fails. SOC 2 and ISO 27001 audits increasingly look for DMARC monitoring as a control. A DMARC record without rua= is enforcement without monitoring — typically a finding.

Common causes

• DMARC record was published with policy only and rua= forgotten.
• The rua mailbox was deleted and never replaced.
• Cross-domain rua= reporting requires a verification record that was never published, so receivers stopped sending.
• Operator deleted rua= because the volume of XML emails was overwhelming and no parser was in place.
• Migration to a new DMARC service did not update the rua= address.

Detect this on your site

Run a quick scan with the Email Checker. The tool surfaces this exact issue with the records and context needed to apply the fix below.

How to fix it

1. 1

   Decide on a reporting destination

   Three options: (1) a self-managed mailbox like dmarc@example.com plus a parser script, (2) a hosted DMARC service like dmarcian, EasyDMARC, Valimail, or Postmark DMARC Digest, (3) a free tier from one of the above for low-volume domains. Hosted services are recommended unless you have engineering capacity for parsing.

2. 2

   Add rua= to your DMARC record

   Update the _dmarc TXT record to include rua=mailto:dmarc-reports@example.com. Multiple addresses are allowed, comma-separated: rua=mailto:dmarc@example.com,mailto:agg@dmarcian.com. Keep the policy unchanged.

3. 3

   Handle cross-domain reporting authorization

   If rua= points to a domain you do not own (e.g. agg@dmarcian.com), the receiving domain must publish a TXT record at example.com._report._dmarc.dmarcian.com with v=DMARC1 to authorize reports. Hosted services handle this automatically.

4. 4

   Verify with dig

   Run dig +short TXT _dmarc.example.com and confirm the record now includes rua=. Wait 24-48 hours and check the reporting mailbox — Google and Microsoft typically send the first report within one day.

5. 5

   Set up a parser or use a hosted dashboard

   Raw XML reports are unreadable without tooling. Open-source parsers include parsedmarc and dmarc-srg. Hosted services dmarcian, EasyDMARC, Valimail, Postmark DMARC Digest provide web dashboards. Pick one and onboard.

6. 6

   Establish a weekly review cadence

   DMARC reports are only useful if someone reads them. Schedule a weekly 15-minute review of new sources, alignment failures, and unusual volumes. New senders should be authenticated before the next review; unauthorized senders are spoofing campaigns to investigate.

Example

; Self-managed reporting
_dmarc.example.com. IN TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@example.com; fo=1"

; Hosted service
_dmarc.example.com. IN TXT "v=DMARC1; p=quarantine; rua=mailto:agg@example.dmarcian.com; fo=1"

; Multiple destinations
_dmarc.example.com. IN TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com,mailto:agg@example.dmarcian.com; fo=1"

DMARC record variants for self-managed, hosted, and dual reporting.

Related fixes