What does the DMARC rua= tag do?

DMARC `rua=` Tag: Aggregate Report URI (rua)

The DMARC rua tag sets where ISPs deliver daily aggregate RUA reports, the XML files showing every sender, IP address, and SPF/DKIM result for your domain. Without it you get no reports.

Published May 10, 2026 · Last verified August 7, 2026 · Maintained by TamingDNS

Importance
Recommended

Tag
rua=

Default
No aggregate reports sent

Example
rua=mailto:[email protected]

✅ Valid Values

mailto: Email address to receive reports (most common). The receiving domain must either match or publish a DMARC record allowing external reports.

https: URL endpoint (rarely used; limited receiver support).

💬 What This Tag Does

The "rua" tag tells receiving ISPs where to send daily aggregate reports in XML format. These reports show every IP that sent mail claiming to be from your domain, along with SPF and DKIM pass/fail counts. Without rua, you're flying blind. You'll have no visibility into who is sending as your domain or where your configuration is failing.

📋 Complete Example Records

Every one of these is a complete record you can paste as it stands. Each goes in a TXT record at _dmarc.yourdomain.com. Check yours with the DMARC Checker or assemble one in the DMARC Builder.

v=DMARC1; p=none; rua=mailto:dmarc-feedback@example.com

One mailbox, which is all most domains need. Point it somewhere that can take a daily XML attachment from every large receiver.

v=DMARC1; p=reject; rua=mailto:dmarc-feedback@example.com,mailto:aggregate@thirdparty.example.net

Two destinations, separated by a comma. A report SHOULD go to each one, so you can keep your own copy while a provider parses them for you.

example.com._report._dmarc.thirdparty.example.net. TXT "v=DMARC1;"

This is the record the provider must publish. Sending reports to an address outside your own domain only works once the receiving domain authorises it this way.

v=DMARC1; p=reject

Enforcement with no reporting, which is the combination to avoid. With no "rua" tag receivers MUST NOT generate aggregate reports, so you are rejecting mail blind.