rua (DMARC reports)
An email address in your DMARC record where aggregate reports about your domain are sent.
Say it out loud
“A daily report from every major provider telling us who is sending email as us. Without it we are publishing policy blind.”
rua is the DMARC tag naming where receivers send aggregate XML reports. They arrive daily, from everyone, and they show which sources sent mail claiming your domain and whether the checks passed. Publishing DMARC without rua is publishing a policy you cannot evaluate.
<source_ip>198.51.100.25</source_ip>
<count>1420</count>
1,420 messages sent as your domain, from an IP. Do you recognise it?
<policy_evaluated>
<disposition>none</disposition>
This is the forgotten-vendor pattern: SPF was updated for them, DKIM never was.
</policy_evaluated>
Reports arrive daily, from every major receiver.
Nobody reads raw DMARC XML twice. Point rua at a parser, not at a human's inbox.
Yours
Nobody does this for you.
What goes wrong
Setting rua to your own work address. Within a week it is hundreds of compressed XML attachments, it gets filtered, and the reason you published DMARC in the first place quietly stops happening.
Not the same as
- ruf (forensic reports)
- Per-failure copies of individual messages. Most large receivers do not send them, and they can contain recipient data, which is why most senders do not ask for them.
The dated rule behind this
A definition is not a citation. These are the pages with the primary source, the date it was published, and what to do about it.
See also
Where this sits
Stop 8, it comes back as numbers. The reactions become a dashboard, and the dashboard is lying to you a little.