What this check looks at
“Without rua= nobody is collecting the reports, so you never find out who is spoofing you.” - the wording shown beside this check while it runs.
rua= in your DMARC record is an address that receiving mail providers send daily
aggregate reports to. Each report lists every server that sent mail claiming to be your
domain, how much it sent, and whether it passed SPF and DKIM.
ruf= is the rarer forensic variant: per-message rather than daily summaries. Most
large providers never send it, for privacy reasons.
Why it matters
This one line is the difference between knowing and not knowing. Without it, receivers still enforce your policy - and nobody tells you anything. You cannot see the phishing campaign using your name, you cannot find the invoicing tool that has been failing SPF for a year, and you have no evidence on which to decide whether enforcement is safe.
Adding it cannot break anything. It changes no delivery decision whatsoever; it only asks for a report. It is the highest-value, lowest-risk change on this entire page.
What each verdict means here
- Pass
- A reporting address is published.
- Warn
- An address is present but malformed, or points somewhere unlikely to be read.
- Fail
- No reporting address, so nobody is collecting anything.
What to do
- Add
rua=mailto:and an address you actually monitor to your existing DMARC record. - Expect XML, in volume, from providers worldwide - a human mailbox is the wrong destination for it.
- Reporting to a domain other than your own requires that domain to publish a record authorising it. Your provider will tell you what to publish.
What this check does not do
We check that an address is published and looks valid. We do not currently receive or parse reports for you - that is the next thing being built, and it is on the roadmap, not in the product today.