DMARC record requests no aggregate reports
What this check looks for
Your DMARC record has no address for receivers to send reports to, so you have no way of finding out who is sending mail as your domain or whether it passes.
Why it matters
Without reports you cannot safely move to enforcement — you would be guessing which of your own systems are about to stop being delivered.
When the check passes, your report says: “Aggregate reports are sent to an address you nominated”.
What it costs your score
When this check fails it removes 4 points from your Email authentication score, before the status, confidence and repeat multipliers are applied. Email authentication carries a weight of 15 in the overall score.
It shares the email-auth.dmarc family ceiling of 40 points: however many findings that family produces, together they cannot remove more than that from Email authentication. One underlying problem showing up in several places is still one problem.
- Severity
- low
- Default confidence
- confirmed
- Status when triggered
- warn
- Deduction
- 4 points
- Family cap
- email-auth.dmarc · 40
- Category
- Email authentication
- Module
- Email dmarc
- Fix owned by
- dns host
- In the ruleset since
- 2026.09
How to fix it
Add a rua= address so receivers report on your mail.
Reports are the only visibility you get into who sends as your domain; they are the prerequisite for safe enforcement.
Choose a mailbox or a DMARC report processor to receive the reports.
Add
rua=mailto:‹rua address›to the record.If the address is on another domain, publish the authorisation record that domain needs.
How to confirm it worked
dig +short TXT _dmarc.‹domain› — expect a rua=mailto: tag
A named slot like ‹domain› — and the braces left in the configuration below — is filled in with your own values when this rule appears on a report.
Technical detail
_dmarc.‹domain› contains no rua= tag. RFC 9990 defines rua as the list of URIs for aggregate feedback; without it, receivers generate no reports. Aggregate reports contain no message content, only per-source counts and authentication results.
Standards and references
Test this on your domain
Run the check that produces this finding, on its own, against any domain.
Other email dmarc checks
- DMARC reports are sent to an unauthorised external domain
- DMARC requests forensic reports (ruf)
- Subdomain has no DMARC record and inherits the parent policy
- More than one DMARC record published
- No DMARC record published
- DMARC record still carries a pct tag
- DMARC policy is p=none (monitor only)
- Subdomains are exempt from an enforcing DMARC policy
- DMARC record has a syntax error
- DMARC is in test mode, so the policy is not applied