dotvitals

DMARC reports are sent to an unauthorised external domain

MediumConfirmedemail.dmarc.external-rua-unauthorised

What this check looks for

Your reports are addressed to a mailbox on a different domain, and that domain has not published the record that says it agrees to receive them. Most receivers will silently send nothing.

Why it matters

You believe you have DMARC visibility and you do not. This is a common failure when a DMARC reporting service is onboarded and only half the setup is done.

When the check passes, your report says: “The external report domain has agreed to receive your reports”.

What it costs your score

When this check fails it removes 8 points from your Email authentication score, before the status, confidence and repeat multipliers are applied. Email authentication carries a weight of 15 in the overall score.

It shares the email-auth.dmarc family ceiling of 40 points: however many findings that family produces, together they cannot remove more than that from Email authentication. One underlying problem showing up in several places is still one problem.

Severity
medium
Default confidence
confirmed
Status when triggered
fail
Deduction
8 points
Family cap
email-auth.dmarc · 40
Category
Email authentication
Module
Email dmarc
Fix owned by
third party
In the ruleset since
2026.09

How the whole score is calculated

How to fix it

Have the receiving domain publish the DMARC report authorisation record.

Without it, RFC 9990 §4 tells receivers not to send the reports, so your reporting is silently dead.

  1. The owner of ‹reporting domain› must publish the authorisation TXT record — if that is your DMARC reporting vendor, they usually have a one-click setting for it.

  2. If the mailbox is on a domain you control, publish the record yourself.

  3. Re-test after publication; report delivery resumes within a day.

How to confirm it worked

  • dig +short TXT ‹domain›._report._dmarc.‹reporting domain› — expect v=DMARC1

The configuration to publish
{{domain}}._report._dmarc.{{reportingDomain}}. 3600 IN TXT "v=DMARC1"

A named slot like ‹domain› — and the braces left in the configuration below — is filled in with your own values when this rule appears on a report.

Technical detail

_dmarc.‹domain› sends reports to ‹report address› on ‹reporting domain›, but no ‹domain›._report._dmarc.‹reporting domain› TXT record was found. RFC 9990 §4 requires this external destination verification so that a domain cannot be used to flood a third party with reports.

Standards and references

Test this on your domain

Run the check that produces this finding, on its own, against any domain.

Open the email dmarc checkerBuild the fix

Other email dmarc checks