What is the rua tag in DMARC (aggregate reports)?

The rua= tag in your DMARC record is where you tell mailbox providers to send your aggregate authentication reports. These are daily summaries of every message that was sent using your domain, broken down by sending source, authentication results, and policy disposition.

An example: rua=mailto:dmarc@yourdomain.com. Every supporting provider (Gmail, Outlook, Yahoo, and many others) will send a compressed XML report to that address every 24 hours. The report shows you: which IPs sent mail claiming to be from your domain, whether those messages passed SPF and DKIM, and whether they passed DMARC alignment.

Why it matters: If you publish DMARC at p=none without an rua= tag, you're not getting any data. You're in monitoring mode but with nothing to monitor. The reports are the whole point of starting at p=none. They're how you discover all your legitimate sending sources before you enforce a stricter policy, and how you spot unauthorized senders or misconfigured ESPs using your domain.

What the reports look like: Raw DMARC aggregate reports are gzipped XML files, which are not fun to read directly. Most senders either use a dedicated DMARC reporting service that processes and visualizes these reports, or run them through a parser. Our free DMARC parser translates them into something readable.

You can also send reports to a third-party reporting service by using their provided address in your rua= tag. Some senders use multiple destinations: rua=mailto:your-inbox@domain.com,mailto:reporting-service@thirdparty.com.

And don\'t confuse rua= with ruf=. The ruf= tag is for forensic reports: individual failure samples sent in near real-time when a message fails DMARC. They're different feeds with different use cases. Understanding both helps you get the most out of your DMARC setup.