DMARC record requests no aggregate reports
The DMARC record has no rua tag, so no aggregate reports are being sent anywhere. The policy still applies, but you have no visibility of which sources are sending as your domain, how much of that mail passes authentication, or what would break if you enforced. DMARC without reporting is a policy you cannot safely change.
Check your own domainDMARC checker
What causes this
The rua tag is the address receivers send daily aggregate reports to. Those reports are the only broad view you get of which systems send mail using your domain and whether they authenticate. Without rua, a p=none policy accomplishes nothing at all: it neither enforces nor informs.
What it breaks
You cannot tell whether raising the policy would break legitimate mail, which is exactly the information needed to move beyond p=none safely.
What the receiving server does
Receivers generate aggregate reports as a matter of course during DMARC evaluation, and send them daily to the addresses in the rua tag. With no rua tag there is nowhere to send them, so they are simply discarded. Nothing else changes: the policy in the p tag is applied exactly as written. The loss is entirely informational, which is why it goes unnoticed, and why domains in this state often sit at p=none for years, because nobody has the evidence needed to justify moving.
Adding reporting to an existing record
The rua tag accepts a comma separated list of URIs, each with the mailto: scheme. Adding it changes nothing about how mail is handled: it only starts the flow of data.
How to fix it
Add an rua address to the record.
- Choose a mailbox or DMARC reporting service to receive the reports.
- Add rua=mailto:that-address to the DMARC record.
- If the address is at a different domain, that domain must publish an authorisation record. See the external reporting finding.
v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com
If you send with
- Choosing where reports go
- Aggregate reports are gzipped XML sent daily by every major receiver, so a shared human inbox is the wrong destination: the volume is real and the format is not readable by eye. Use a dedicated mailbox and a parser, or a DMARC reporting service that provides the address.
- Reporting to a different domain
- If the rua address is at a different domain from the one the record covers, that other domain must publish a record authorising it to receive your reports. Without it, most receivers will not send. This is the most common reason reporting silently fails after being configured.
Confirming the fix worked
- Add the rua tag with a mailto: URI and publish the record.
- Wait 24 to 48 hours. Aggregate reports arrive on a daily cycle, so nothing appears immediately.
- Confirm reports are arriving from more than one receiver. A single source suggests something is filtering them.
- If the address is on another domain, confirm the external reporting authorisation record exists at that domain.
Common questions
- Does a missing rua tag stop DMARC from working?
- No. The policy in the p tag is applied normally. What you lose is the reporting, and with it any evidence about who sends as your domain, which in practice is what stops most rollouts from progressing.
- What is the difference between rua and ruf?
- rua receives aggregate reports: daily XML summaries of volumes and authentication results, with no message content. ruf receives forensic reports on individual failing messages, which can contain message data. Aggregate reporting is widely supported; forensic reporting is sent by relatively few receivers, largely for privacy reasons.
- Can I send reports to more than one address?
- Yes. The tag takes a comma separated list of mailto: URIs, which is how you feed both your own mailbox and a reporting service from a single record.
- How long until reports start arriving?
- Usually within 24 to 48 hours, because most receivers generate them once a day. If nothing has arrived after three days, check the mailto: scheme is present and, for an address on another domain, that the authorisation record exists.