Skip to content
critical

DMARC external destination not authorized — why you receive no reports

If your rua= or ruf= address is at a different organizational domain than the one publishing the DMARC record, RFC 7489 §7.1 requires that other domain to opt in. Without it, anyone could point their reports at a victim and use the world's mail receivers as an amplifier.

The opt-in is a TXT record at yourdomain.com._report._dmarc.thirdparty.example containing v=DMARC1. Until it exists, compliant receivers — including Google and Microsoft — silently discard your reports.

This is the number one reason a domain "has DMARC" for months and has never seen a single report.

How to fix it

  1. 1Identify the host part of each rua=/ruf= address that is not on your own organizational domain.
  2. 2Ask that provider to publish: yourdomain.com._report._dmarc.theirdomain.example IN TXT "v=DMARC1"
  3. 3Most DMARC analytics vendors do this automatically when you add a domain in their dashboard — if reports are missing, that step was skipped.
  4. 4Alternatively, point rua= at a mailbox on your own domain, which needs no authorization record.
  5. 5Re-scan to confirm the authorization record is visible.

Check whether your domain has this problem

Free, no signup, about two seconds. You get the exact record to paste.

Related guides