Set up a DMARC reporting mailbox (rua) and authorize an external domain

What it means

The rua tag in your DMARC record tells receivers like Google, Microsoft and Yahoo where to send their daily aggregate reports. These reports list every server that sent email with your domain, and whether SPF, DKIM and DMARC passed.

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

If the address is on the same domain, nothing else is needed. If it is on another domain, that other domain must agree to receive your reports, with a special DNS record.

Why it matters

• Without rua, you get no reports, and moving to quarantine or reject becomes guesswork.
• Reports are sent automatically, every day, by many companies. They can quickly fill a personal inbox.
• If the external authorization is missing, receivers silently ignore your reporting address.

How to check

Delivmail checks this for you in two ways:

• Send a test email: on the home page (/), copy your unique test address, send it a normal email from the mailbox or tool you want to check, then open the report.
• Use the Domain scanner: type your domain at /domain-scanner to read your SPF, DMARC and MX records without sending anything.

The scanner shows your DMARC record, including its rua address.

How to fix it

1. Create a dedicated mailbox

Use an address used only for reports, such as dmarc@yourdomain.com or dmarc-reports@yourdomain.com. Do not use your personal inbox. A free alias or group that forwards to a folder also works.

2. Add it to your DMARC record

Edit the TXT record at _dmarc.yourdomain.com. Several addresses are separated by a comma:

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com,mailto:reports@dmarc-service.example

Keep the mailto: prefix before each address.

3. Address on another domain: add the authorization

Say yourdomain.com sends reports to dmarc@otherdomain.com. The owner of otherdomain.com must publish a TXT record at:

yourdomain.com._report._dmarc.otherdomain.com   TXT   "v=DMARC1"

The name is your domain, then _report._dmarc, then the domain that receives the reports. Note:

• Reporting services usually publish this for you. If you use your own second domain, you add it yourself.
• A domain receiving reports for many domains can publish a single wildcard record at *._report._dmarc.otherdomain.com.
• Each of your domains, and each subdomain with its own DMARC record, needs its own authorization unless a wildcard exists.

4. Make reports useful

Reports are compressed XML files, hard to read by hand. You can read them with a free viewer or a monitoring service. Delivmail DMARC monitoring in the paid dashboard collects them for you and lists your sending sources.

Common mistakes

• Forgetting mailto:, or adding spaces inside the address list.
• A full mailbox that rejects incoming reports.
• An external address without the _report._dmarc record.

Check that it is fixed

Run the Domain scanner again: your DMARC record should be valid and show the reporting address. Reports arrive about once a day from each large provider, so wait 24 to 48 hours. If nothing arrives after a few days of normal sending, check the spelling, the mailbox storage and the external authorization.