← All checks

DMARC rua reporting not set up or not authorised

DMARC reporting low Email authentication · 3 of 100 points

What it inspects

The rua= tag of the DMARC record. Verdicts: PASS when rua lists mailto: addresses and every address at another organisation has published the authorisation record. WARN when there is no rua, when an entry is not a valid mailto: address, or when an external destination has not authorised reports (TXT at <your-domain>._report._dmarc.<destination>). Not applicable when there is no usable DMARC record; SKIP if the authorisation lookup failed.

Why it matters

Aggregate reports are how you find out who sends mail as your domain, which you need before you can safely move to p=reject. Reports sent to an unauthorised external address are discarded by receivers, so you silently get nothing.

How to verify by hand

# bash: the rua value, then the authorisation record on the destination
dig +short TXT _dmarc.example.com
dig +short TXT example.com._report._dmarc.reports.provider.example

# PowerShell
Resolve-DnsName -Name _dmarc.example.com -Type TXT | Select-Object -ExpandProperty Strings
Resolve-DnsName -Name example.com._report._dmarc.reports.provider.example -Type TXT | Select-Object -ExpandProperty Strings

How to fix

Add a rua= address to the DMARC record. If it is at another organisation, that organisation must publish an authorisation record.

  1. Request reports:

    _dmarc.example.com.  IN  TXT  "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com"

  2. If the address is at another domain, that domain publishes (report processors do this for you):

    example.com._report._dmarc.reports.provider.example.  IN  TXT  "v=DMARC1"

References

Scan your domain free