Do I need this if reports go to an address at my own domain?

No. The authorisation is only required when the reporting address is at a different domain from the one the DMARC record covers. Same-domain reporting needs nothing extra.

Which domain publishes the authorisation record?

The one receiving the reports. It is a statement of consent by the destination, so publishing it on your own domain has no effect.

Why do I get no error when this is missing?

Because receivers decline to send rather than failing. There is no bounce and nothing appears in your DNS or mail logs. The only symptom is reports that never arrive, which is easily mistaken for a domain nobody is spoofing.

Does a subdomain of my own domain count as external?

No. Addresses within the same organisational domain, including subdomains, are not treated as external and need no authorisation record.

MediumPolicy

External reporting address is not authorised

The DMARC record sends reports to an address at a different domain, and that domain has not published a record authorising it. Receivers check for that authorisation before sending, and most will silently decline, so the reporting you configured is not arriving, and the absence looks identical to having no reports to send.

Check your own domainDMARC checker

What causes this

When a DMARC rua or ruf address is at a different domain from the one being reported on, the receiving domain must publish a record at yourdomain.com._report._dmarc.theirdomain.com saying it accepts reports for you. Without it, conforming receivers refuse to send the reports. This is easy to miss because the DMARC record itself looks perfectly valid.

What it breaks

Aggregate reports are not delivered, so the policy produces no data even though it appears configured.

What the receiving server does

When the rua or ruf address is outside the domain the record covers, a receiver performs an additional DNS lookup before sending anything. For reports about example.com going to dmarc@vendor.example, it queries example.com._report._dmarc.vendor.example and expects a TXT record beginning v=DMARC1. That record is the receiving domain saying it consents to accept reports about yours. Without it the receiver has no confirmation the destination wants the data, and declines to send quietly, with no bounce and nothing in your logs.

The authorisation record, and where it lives

The record goes on the domain that receives the reports, not on the domain being reported about. That is what makes it consent rather than a claim: you cannot authorise yourself to receive someone else's reports.

your_dmarc.example.comyour record, with rua=mailto:dmarc@vendor.example

theirexample.com._report._dmarc.vendor.examplethe authorisation, published on the receiving domain

valuev=DMARC1that alone is sufficient: it means reports about example.com are accepted

any*._report._dmarc.vendor.examplea wildcard, used by reporting services to accept reports about any domain

How to fix it

Publish the authorisation record at the reporting domain.

At the domain that receives the reports, create a TXT record named yourdomain.com._report._dmarc.
Set its value to v=DMARC1.
If the reporting address belongs to a vendor, they normally publish this for you. Check their setup guide.

If you send with

Using a DMARC reporting service: Established services publish a wildcard authorisation, so external reporting works as soon as you add their address. If reports are not arriving after a few days, that is worth confirming with them rather than assuming: it is a common cause of a reporting account that never populates.
Sending reports to your own second domain: If you consolidate reporting for several domains into one mailbox, every reported-on domain needs an authorisation record at the mailbox domain. Consolidating ten domains means ten records, or one wildcard if the mailbox domain is entirely yours.

Confirming the fix worked

Confirm whether the rua address is at the same domain as the DMARC record. If it is, no authorisation is needed and this does not apply.
Publish the TXT record at <reported-domain>._report._dmarc.<report-receiving-domain> with the value v=DMARC1.
Wait 24 to 48 hours and confirm reports begin arriving from multiple receivers.
If you use a reporting service, check whether they publish a wildcard before publishing a record per domain.

Common questions

Do I need this if reports go to an address at my own domain?: No. The authorisation is only required when the reporting address is at a different domain from the one the DMARC record covers. Same-domain reporting needs nothing extra.
Which domain publishes the authorisation record?: The one receiving the reports. It is a statement of consent by the destination, so publishing it on your own domain has no effect.
Why do I get no error when this is missing?: Because receivers decline to send rather than failing. There is no bounce and nothing appears in your DNS or mail logs. The only symptom is reports that never arrive, which is easily mistaken for a domain nobody is spoofing.
Does a subdomain of my own domain count as external?: No. Addresses within the same organisational domain, including subdomains, are not treated as external and need no authorisation record.