Sending reports to an address outside your own domain requires the receiving domain to agree, in DNS. Without that record, conforming receivers silently send nothing — which is the most common reason a correctly configured rua produces no reports.
Why the permission exists
Without it, anyone could publish rua=mailto:victim@example.org on a thousand domains and have the world’s mail receivers deliver reports to a party that never asked for them. RFC 7489 §7.1 closes it by requiring the destination domain to opt in.
The record
<your-domain>._report._dmarc.<destination-domain> IN TXT "v=DMARC1;" example.com._report._dmarc.processor.example. IN TXT "v=DMARC1;" "example.com may send DMARC reports to addresses at processor.example"
It lives in the destination’s zone, not yours, and it names your domain. Every processor publishes these for its customers automatically — which is why this is usually invisible until you point rua at a domain you own but have not authorised.
Live examples
"v=DMARC1;" "v=DMARC1;"
Note how little the record contains. v=DMARC1; is the whole of it — the authorisation is carried by the record existing at that name, not by anything in its value.
The case that catches you
Reports for brand-a.com sent to dmarc@brand-b.com need an authorisation in brand-b.com’s zone, even though you own both. DNS has no notion of common ownership.
- Publish one
_report._dmarcrecord per source domain, in the destination zone. - A wildcard is possible and is a standing offer to receive anyone’s reports.
- Adding a domain to an estate means adding its authorisation record too, or it reports nothing.
The failure is silent
A receiver that cannot find the authorisation does not bounce, warn or log anything you can see. You simply get no reports from that receiver, indefinitely, while the record looks correct. If reports are thin, check the authorisation before checking anything else.