MediumPolicy · usually medium
External reporting address is not authorised
Reports are directed to another domain that has not published the required authorisation record.
Check your own domain
What causes this
When a DMARC rua or ruf address is at a different domain from the one being reported on, the receiving domain must publish a record at yourdomain.com._report._dmarc.theirdomain.com saying it accepts reports for you. Without it, conforming receivers refuse to send the reports. This is easy to miss because the DMARC record itself looks perfectly valid.
What it breaks
Aggregate reports are not delivered, so the policy produces no data even though it appears configured.
How to fix it
Publish the authorisation record at the reporting domain.
- At the domain that receives the reports, create a TXT record named yourdomain.com._report._dmarc.
- Set its value to v=DMARC1.
- If the reporting address belongs to a vendor, they normally publish this for you — check their setup guide.
Specification: RFC 7489 — DMARC
Related problems
- BIMI record published without DMARC enforcementBIMI requires a DMARC policy of quarantine or reject. The record will be ignored.
- DMARC record requests no aggregate reportsThere is no rua address, so you receive no data about who sends as your domain.
- DMARC policy is set to noneThe policy monitors but does not act — failing mail is still delivered.
- Subdomain policy is weaker than the domain policysp= is set to a laxer value than p=, leaving subdomains less protected.
- Non-sending domain is not protected against forgeryThis domain appears not to send mail, but publishes no policy preventing others from doing so.