No rua, no reports: the DMARC tag 46% of records are missing

In DMARCguard's 27 February 2026 scan of 5,499,028 domains, 46.49% of DMARC records had no rua tag. Those domains publish a policy and get no feedback from it.

What rua does

rua lists where receiving mail providers send your aggregate reports, typically once a day per provider. The reports say which IPs sent mail as your domain, how much, and whether it passed SPF, DKIM and DMARC. You get a separate report from each receiving provider that supports reporting, and the first ones usually arrive within a day or two of adding rua.

Without rua, the policy still runs. You just can't see what it's doing.

A minimal record with reporting:

_dmarc.example.com TXT "v=DMARC1; p=none; rua=mailto:[email protected]"

If the reports go to another domain, say reports.example.net, that domain publishes an authorization record:

example.com._report._dmarc.reports.example.net TXT "v=DMARC1"

Three checks

1. Your _dmarc TXT record contains rua=mailto:... at all.

2. The address goes to a mailbox or processor that parses XML unattended. A person's inbox fills with compressed XML attachments nobody opens, and the useful part, which sources fail, never gets read.

3. If the address is on a different domain from yours, that domain must publish a _report._dmarc TXT record authorizing your domain. When reports stop arriving, check this first.

Why it matters before enforcement

Moving from p=none to p=quarantine safely depends on knowing every legitimate sender. Aggregate reports are how you find them. Without rua you're guessing.

What to do today: look up your DMARC record and run through the three checks. If you need somewhere to send the reports, a processor that parses them beats a shared mailbox. It's one tag, and every later DMARC change depends on it.

The longer guide, including why reports go missing: https://dmarcguard.io/blog/dmarc-rua-collection/?utm_source=buymeacoffee&utm_medium=social&utm_campaign=social-2026-w45&utm_content=1107-eu-rua