Written by Venkat Nookala · Last updated 2026-08-10
Most DMARC advice tells you to get to p=reject. Almost none of it tells you what happens if you get there without a rua= tag.
Here is what happens: mailbox providers start rejecting mail that fails alignment, and you receive no reports about it. The policy works. The reporting does not exist. So the enforcement is real and the visibility is zero.
Rejected mail does not bounce back to you. The receiving server refuses it and tells the sending server, not you. If the sending server is a tool you use (a CRM, an invoicing system, a new marketing platform), that tool may or may not surface the failure.
So the failure mode is: one of your own sending sources starts failing alignment, its mail is destroyed at the receiver, and nothing in your stack reports it. You find out weeks later when someone mentions they never got your email.
dig +short TXT _dmarc.yourdomain.comIf the record contains p=reject or p=quarantine and does not contain rua=, you are enforcing without reporting.
Add one tag to the record you already have:
rua=mailto:[email protected]That changes nothing about delivery. rua= is a reporting address, not a policy. It turns the reports on.
Two things to know before you do it. Reports arrive as XML attachments, daily, from every provider that receives your mail. That can be dozens of messages. Most teams point rua= at a dedicated mailbox or a report processor rather than a person's inbox. And if you point it at an address on a different domain than the one you are protecting, that domain has to publish an authorization record or the reports are discarded silently.
We checked two domains that publish p=reject with no rua= tag, against three widely used DMARC checkers, on 10 August 2026.
| Tool | Verdict |
|---|---|
| MXToolbox | Did not mention it |
| EasyDMARC | “Valid” |
| dmarcian | “Well done! Your domain takes full advantage of the domain protections afforded by DMARC” |
The dmarcian result is the one worth reading twice. It is a company that does nothing but DMARC, and it told a domain that is enforcing blind: “Well done! Your domain takes full advantage of the domain protections afforded by DMARC”.
We are not claiming those tools are bad. They are checking whether the record is syntactically valid, and it is. Nothing in that record is malformed. What is missing is a tag that is optional by specification and load-bearing in practice.
That gap is the reason this page exists.
Two domains, three tools, checked manually on 10 August 2026 and recorded verbatim. Domain names withheld. They are real companies and this is their configuration, not their fault. You can reproduce the finding on any domain: publish p=reject with no rua= and run it through the three tools yourself.