DMARC record requests no aggregate reports
Updated
6% of the 866 domains we could check get a warning for this. Sample: the first 1,000 domains by rank in the Majestic Million, checked on 2026-10-12. How we measured
What this check looks for
Your DMARC record has no address for receivers to send reports to, so you have no way of finding out who is sending mail as your domain or whether it passes.
Why it matters
Without reports you cannot safely move to enforcement — you would be guessing which of your own systems are about to stop being delivered.
When the check passes, your report says: “Aggregate reports are sent to an address you nominated”.
What it costs your score
When this check fails it removes 4 points from your Email authentication score, before the status, confidence and repeat multipliers are applied. Email authentication carries a weight of 15 in the overall score.
It shares the email-auth.dmarc family ceiling of 40 points: however many findings that family produces, together they cannot remove more than that from Email authentication. One underlying problem showing up in several places is still one problem.
- Severity
- low
- Default confidence
- confirmed
- Status when triggered
- warn
- Deduction
- 4 points
- Family cap
- email-auth.dmarc · 40
- Category
- Email authentication
- Module
- Email dmarc
- Fix owned by
- dns host
- In the ruleset since
- 2026.09
How to fix it
Add a rua= address so receivers report on your mail.
Reports are the only visibility you get into who sends as your domain; they are the prerequisite for safe enforcement.
Choose a mailbox or a DMARC report processor to receive the reports.
Add
rua=mailto:‹rua address›to the record.If the address is on another domain, publish the authorisation record that domain needs.
How to confirm it worked
dig +short TXT _dmarc.‹domain› — expect a rua=mailto: tag
A named slot like ‹domain› — and the braces left in the configuration below — is filled in with your own values when this rule appears on a report.
Technical detail
_dmarc.‹domain› contains no rua= tag. RFC 9990 defines rua as the list of URIs for aggregate feedback; without it, receivers generate no reports. Aggregate reports contain no message content, only per-source counts and authentication results.
Standards and references
Test this on your domain
Run the check that produces this finding, on its own, against any domain.