Skip to content
DomainGrade

What we checkEmailEM-06

DMARC reporting

A rua= address is how you find out who is sending mail as your domain.

Area
Email
Check
EM-06
Included
Free in every scan

What we check

We check for a rua= tag in your DMARC record and whether the address is on your own domain.

Why it matters

Without reporting you are enforcing a policy blind. You cannot tell whether a tightened policy is blocking forgeries or your own invoicing system.

Aggregate reports are also the only routine way to discover a service that has been sending as you for years without anyone remembering it.

Reports are also how you discover the senders nobody remembers. A marketing platform from two years ago, a monitoring tool that emails alerts as you, a payment provider — each shows up as a source in the first week of reports, and each is a delivery failure waiting for the day you tighten the policy without knowing about it.

How to fix it

  1. 1

    Add rua=mailto:dmarc@yourcompany.com to your DMARC record.

  2. 2

    Reports arrive as compressed XML — a free parsing service or your mail provider's dashboard makes them readable.

Common questions

Can I send reports to an address at another domain?
Yes, and DMARC processors are the normal way to read them. The other domain must publish a record authorising it, which the processor documents. We report an external rua as configured rather than verified.
What is ruf=?
Forensic reports: individual failed messages rather than daily aggregates. Most receivers do not send them, and they can contain personal data, so rua is where the value is.
How much mail will this generate?
One report per receiving provider per day — typically a handful, not a flood.

See how your domain does on this check.

All 34 checks, a grade, and the exact fix for anything that isn’t right — in about twenty seconds, no signup.

Other email checks