Why your DMARC reports never arrive: external destination authorisation

You published a DMARC record with a rua address. Weeks later, no reports have arrived. The record validates in every checker you try. Nothing is in your spam folder.

If the reporting address is on a different domain from the one being reported on, the cause is almost certainly RFC 7489 §7.1: the receiving domain has to publish a record authorising yours, and without it conforming receivers discard the reports without telling anyone.

The symptom

This failure is unusually hard to diagnose because every visible signal says the configuration is correct:

• The DMARC record is syntactically valid and every generic checker passes it.
• The mailbox exists and receives other mail normally.
• No bounce, no error, no log entry anywhere you control.
• Some reports may still arrive — from receivers that do not implement the check.

That last one is the cruellest part. Partial delivery makes it look like a volume problem rather than a configuration one, and people spend a long time looking at the wrong thing.

The rule

DMARC reports contain information about mail sent as your domain. If you could name any mailbox in the world as the destination, DMARC would be a convenient way to direct a stream of traffic at a third party, and to learn about someone else's mail flow by naming your own address in their reports. So the spec requires consent from the receiving side.

Consent is expressed as a DNS record published by the destination domain, in this shape:

<reported-domain>._report._dmarc.<destination-domain>.  IN  TXT  "v=DMARC1"

A receiver that is about to send you a report looks this up first. No record, no report.

The record you need

Suppose example.com sends its reports to a processor at reports.vendor.example:

; in example.com — what you publish
_dmarc.example.com.  IN  TXT  "v=DMARC1; p=none; rua=mailto:ex@reports.vendor.example"

; in reports.vendor.example — what THEY must publish
example.com._report._dmarc.reports.vendor.example.  IN  TXT  "v=DMARC1"

In practice a commercial DMARC processor handles this for you, usually by giving you a unique mailbox and publishing the authorisation when you add the domain in their dashboard. The cases where it goes wrong are:

• You added the rua to your DNS before adding the domain in the vendor's dashboard, and never went back.
• You are sending reports to a domain you own but did not configure — a second corporate domain, or a subdomain with its own zone.
• You copied a rua address out of a blog post or another domain's record. That address is authorised for them, not for you.

PayPal's record is a good example of the normal case — two external processors, both of which have published the authorisation on their side:

"v=DMARC1; p=reject;
  rua=mailto:d@rua.agari.com,mailto:dmarc_agg@vali.email;
  ruf=mailto:d@ruf.agari.com,mailto:MTc4Mzcw@ruf.vali.email"

Checking it

You can verify it by hand for any destination:

"v=DMARC1"

The DMARC Inspector does this automatically for every destination in your record, including ruf, and tells you which ones are authorised. It is one of the few checks where a clean result genuinely means something — most tools do not look at all.

Details that catch people out