dotvitals

DMARC requests forensic reports (ruf)

InfoConfirmedemail.dmarc.forensic-reporting-enabled

What this check looks for

Your record asks receivers to send you copies of individual failing messages. Few receivers do this, and the ones that do may send you other people's personal data.

Why it matters

You gain very little — most receivers ignore ruf entirely — and you take on a privacy obligation for message content that arrives in that mailbox.

What it costs your score

This check never deducts. It reports a fact — or reports that something could not be verified — and is shown on the report without moving the score.

Severity
info
Default confidence
confirmed
Status when triggered
info
Deduction
0 points
Family cap
none
Category
Email authentication
Module
Email dmarc
Fix owned by
dns host
In the ruleset since
2026.09

How the whole score is calculated

How to fix it

Keep ruf only if you have somewhere to put the data and a reason to read it.

Failure reports may contain personal data and are rarely sent, so the cost usually outweighs the value.

  1. Confirm the receiving mailbox is access-controlled and covered by your privacy notice.

  2. If nobody reads them, remove the ruf= and fo= tags.

How to confirm it worked

  • dig +short TXT _dmarc.‹domain› — check whether a ruf= tag is present

A named slot like ‹domain› — and the braces left in the configuration below — is filled in with your own values when this rule appears on a report.

Technical detail

_dmarc.‹domain› sets ruf=‹ruf address›. RFC 9991 §2 defines failure reports as containing message headers and potentially the body. Support is sparse and shrinking, largely for the privacy reason: a forensic report about a forwarded message can contain a third party's content.

Standards and references

Test this on your domain

Run the check that produces this finding, on its own, against any domain.

Open the email dmarc checkerBuild the fix

Other email dmarc checks