How to Check DMARC rua and ruf Report Addresses for Many Domains

To check DMARC report addresses, read each domain's TXT record at _dmarc.<domain>, then test every rua and ruf address in it. The bulk DMARC report address checker does that for up to 100 domains a run, or 500 after a free Google sign-in. Each row lists every address and whether it can receive reports. It reads DNS only; nothing is emailed.

What rua and ruf do

rua= says where aggregate reports go (daily summaries of who sent mail as your domain and whether it passed), and ruf= says where failure reports go (copies of individual failed messages). Both take URIs, usually mailto: addresses, as defined in RFC 7489. Without a working rua address a domain at p=none collects nothing, which defeats a monitoring policy. See how to read DMARC aggregate reports for what to do when they arrive.

Doing it by hand

dig +short TXT _dmarc.example.com
dig +short TXT example.com._report._dmarc.reports-service.com
dig +short MX example.com

The first shows the record and its rua address. If that address is on a different domain, the second checks the authorisation record, in the form <your-domain>._report._dmarc.<their-domain>, which should start v=DMARC1. If the address is on your own organisation's domain, the third confirms it has mail records. Repeat for every domain.

Why another domain must agree

If a report address is on a different domain from the one publishing the record, a receiver is meant to check that the other domain agrees to receive reports. RFC 7489 section 7.1 says it looks for a TXT record at <your-domain>._report._dmarc.<their-domain>, and a wildcard at *._report._dmarc.<their-domain> also works. Reporting services publish these for their customers. If you point rua at one and the record is missing, receivers that follow the RFC skip the address and nothing arrives.

Step 1: paste the domains

Paste domains, email addresses or URLs, one per line. Use up to 100 a run, or 500 after a free Google sign-in.

Step 2: run the check

Each domain's DMARC record is read, then each mailto: address is tested, 10 domains a request. An address on another organisation's domain is checked for the authorisation record. One on the same organisation is checked for MX records, or an address record that senders may use as an implicit MX. A !10m size limit on an address is ignored for these tests.

Step 3: read each row

Result	What it means	What to do
Reports can arrive	Every address passed	Nothing to fix
Has issues	The first problem is shown	Fix the record or the authorisation, then check again
No rua or ruf	A DMARC record with no report address	Add a rua address if you want reports
No DMARC record	Nothing at the _dmarc name	Publish one. See validating a DMARC record
Lookup failed	DNS did not answer properly	Try again later

What this check cannot do

• It checks DNS only. It cannot tell whether reports arrive or anyone reads them, or whether a mailbox is full.
• https report endpoints are listed but not called, so they show as not tested.
• Only the first DMARC record is used for the address tests, and a second record is flagged.
• The limit is 100 domains a run without an account and 500 signed in.

To check the policy itself across a list, use the bulk DMARC checker. For record examples, see DMARC record examples.

Check the addresses you send to

Correct DNS gets mail to the door; the address still has to exist. Upload your list on the verify page: the first 100 email checks are free with a Google sign-in, no card. Each address comes back valid, risky or invalid with a reason, and nothing is sent to anyone on the list. For larger or recurring lists, see bulk email verification, list cleaning and pricing.

Check your domains now

Paste them into the bulk DMARC report address checker.