auth.dmarc.external_unauthorized
External DMARC Report Destination Not Authorized
What we check
When a DMARC rua=/ruf= address is on a different domain than the one being scanned, RFC 7489 §7.1 requires that other domain to publish an authorization record before receivers will send it reports. We query for that record at <domain>._report._dmarc.<reportDomain>.
What this finding means
Your DMARC record points reports at an address on another domain — typically a third-party DMARC-reporting service — but that domain has not published the authorization record confirming it agrees to receive reports for you. Without it, receivers may silently drop the reports, so you get incomplete data or none at all.
This is a deliberate anti-abuse control: it stops anyone from directing floods of DMARC reports at a victim domain by naming it in their rua.
Why it matters
- Reports may never arrive. Standards-compliant receivers won't send aggregate reports to an unauthorized external destination, so your visibility is degraded even though the policy looks complete.
- Silent failure. Nothing bounces or errors — the reports simply aren't sent, which is easy to miss until you notice the report volume is lower than expected.
- Common with reporting services. The authorization record is usually the reporting provider's job to publish; a missed onboarding step leaves it absent.
How to fix
Have the report domain publish the authorization record. For a
ruaofdmarc@reports.example.neton your domainexample.com,reports.example.netmust publish:example.com._report._dmarc.reports.example.net. IN TXT "v=DMARC1"If you use a DMARC-reporting service, ask them to add the authorization record for your domain — most do this automatically during onboarding, but it can be missed.
Or move reporting to your own domain, where no external authorization is required.
How it's graded
An unauthorized external report destination carries a 10-point deduction in the Authentication category. See Grading Methodology for the full scoring model.
Evidence example
DMARC record: "v=DMARC1; p=reject; rua=mailto:dmarc@reports.example.net"
$ dig +short TXT example.com._report._dmarc.reports.example.net
(empty — reports.example.net has not authorized reports for example.com, RFC 7489 §7.1)