auth.dmarc.no_rua
DMARC Missing Aggregate Report URI
What we check
We check the DMARC record for an rua= tag. rua is the address to which receivers send aggregate reports — the daily XML summaries of who is sending mail as your domain and whether it passes SPF and DKIM alignment.
What this finding means
The DMARC record has no rua= destination. The policy may enforce correctly, but you receive no aggregate reports — so you have no visibility into who is sending under your domain, which sources pass or fail authentication, or whether a tightening step is safe.
Aggregate reporting is what makes a safe rollout possible. Without it, moving from none to quarantine to reject is guesswork: you can't see which legitimate senders would break.
Why it matters
- Flying blind.
ruareports are the only standardized way to see every IP sending as your domain — legitimate services and attackers alike. Without them, you can't verify alignment before enforcing. - Risky tightening. Advancing the policy without report data risks blocking a legitimate sender you didn't know about.
- Reduced operational awareness. Aggregate reports also surface new spoofing campaigns and newly-added internal senders that fell out of alignment.
How to fix
Add an
rua=address (a mailbox you monitor, or a DMARC-reporting service that parses the XML for you):_dmarc.example.com. IN TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@example.com"If the report address is on another domain, that domain must authorize it (see the external-destination finding) — otherwise receivers may silently drop the reports.
How it's graded
A missing rua carries a 10-point deduction in the Authentication category. See Grading Methodology for the full scoring model.
Evidence example
$ dig +short TXT _dmarc.example.com
"v=DMARC1; p=quarantine"
^ no rua= tag — no aggregate reports delivered