DMARC reporting diagnostics
DMARC reports not received: External report destination is not authorized
If your DMARC policy sends reports to another domain, that destination normally needs a public authorization record. MailFixIt checks that prerequisite without pretending that DNS can guarantee report delivery.
A DMARC record requests aggregate reports at an address outside the policy domain, but reports do not arrive.
v=DMARC1; p=none; rua=mailto:dmarc@reports.example.net
Run this automated test on my domain
Enter your domain. MailFixIt checks the relevant DNS records automatically and shows the evidence.
What this DMARC report problem means
DMARC receivers use external-destination verification to prevent one domain from directing large report volumes at an unrelated domain. For a policy on example.com that sends reports to reports.example.net, the report destination controls the required authorization. An absent record can explain why participating receivers skip that external address.
What the DNS check does and does not prove
The diagnostic reads the public DMARC policy, extracts external rua and ruf destinations, and queries each corresponding authorization name. It distinguishes a confirmed absence from a temporary or indeterminate DNS response.
A valid authorization record does not prove that reports must arrive. DMARC reporting is receiver-dependent, and reports can be delayed, filtered, rate-limited or sent only when the receiver has relevant traffic to summarize.
Possible diagnostic results
Authorization found
The external DNS prerequisite is present. Check mailbox handling, report parsing and whether participating receivers have seen mail for the domain.
Authorization absent
The destination domain has not publicly authorized reports from this policy domain. Ask its DNS administrator or reporting vendor for the exact record.
No external destination
The reporting mailbox uses the same organizational domain, so this particular authorization mechanism is not the likely cause.
DNS result indeterminate
A timeout or temporary resolver failure is not treated as proof of misconfiguration. Recheck before changing DNS.
How to fix external DMARC report authorization
- Confirm that the destination mailbox and domain are controlled by you or your reporting provider.
- Obtain the exact authorization owner name and TXT value from that destination owner.
- Publish the record in the destination DNS zone, not automatically in the sending domain's zone.
- Wait for DNS publication, rerun the check, then monitor multiple participating receivers over a realistic reporting interval.
The names below are fictional. Use the exact names produced for your domains.
Before: example.com._report._dmarc.reports.example.net. TXT (absent) After: example.com._report._dmarc.reports.example.net. TXT "v=DMARC1;"
Rollback by removing only the newly added authorization record if the destination was entered incorrectly.
Verify the repair
First confirm that the authorization name resolves publicly from more than one resolver. Then keep the DMARC policy stable while monitoring the destination. This separates DNS propagation from receiver timing and avoids changing several variables at once.
Frequently asked questions
Does an authorization record guarantee that DMARC reports will arrive?
No. The record authorizes an external destination, but each receiver decides whether and when to send reports. Mailbox delivery, filtering and report-volume limits can also affect receipt.
Where is external DMARC report authorization published?
It is published in the DNS zone of the report destination, at a name formed from the policy domain, _report._dmarc, and the destination domain. The destination owner must approve that publication.
Related email diagnostics
Primary sources: RFC 7489: Verifying External Destinations, RFC 9990: external reporting authorization update.