Bulk DMARC report address checker: can each rua and ruf address receive reports?
In short: Paste domains and see every rua and ruf address in each DMARC record tested: an address on another domain needs an authorisation record, and one on your own needs mail records. Limit: Only DNS is checked. It can't tell whether reports arrive or anyone reads them.
A bulk DMARC report address checker tests where each domain asks for its DMARC reports to go. Paste up to 100 domains, or 500 after a free Google sign-in, and each row lists every rua and ruf address, whether an address on another domain has authorised it (RFC 7489 section 7.1) and whether the mailbox's domain can receive mail. DNS only; nothing is emailed. Download the results as CSV.
Price: this tool is free. Checking a whole email list is from $9/mo, and the first 100 checks are free with Google, no card. Check your list free nowSee pricing
Sample result
acme.example's report mailbox can receive reports; globex.example's reporting service hasn't authorised it.
- Domain
- globex.example
- rua
- dmarc-service.example
- Authorisation record
- Missing
What this means for you
An external report address with no authorisation record is skipped by receivers that follow RFC 7489.
- Every rua and ruf address tested
- External authorisation record checked
- Same-domain mail records checked
- Nothing emailed; CSV out
- DMARC
- rua
- ruf
By SimpleVerifier Team · Last updated
Auditing the email DNS of a domain list?
- Paste the domains here: up to 100 a run, or 500 after a free Google sign-in. Filter to the rows that need a fix and download the CSV.
- Upload or paste it at /verify. Every address gets a live mailbox check, and the first 100 email checks are free with a Google sign-in, no card.
How do I check the DMARC report addresses of many domains?
- Paste domains, email addresses or URLs, one per line, up to 100 a run or 500 after a free Google sign-in.
- Press Check report addresses. Each domain's TXT record at _dmarc.<domain> is read over DNS, then each rua and ruf mailto: address is tested, 10 domains a request. Nothing is emailed and no https endpoint is called.
- Read each row: Reports can arrive, Has issues (the first problem is shown), No rua or ruf, No DMARC record, or Lookup failed, with every address and its result.
- Filter to the domains with issues, fix the records, and download the CSV.
Example
- You enter
- Three domains:
acme.example(rua to a mailbox on its own domain),globex.example(rua to a reporting service's domain) andinitech.example(no DMARC record). - You get
- acme.example: Reports can arrive, the mailbox's domain has MX records. globex.example: Has issues, the service's domain has no authorisation record at globex.example._report._dmarc.<service>. initech.example: No DMARC record. Download the CSV.
- Limits
- Up to 100 a run without an account and 500 when signed in with Google, counted over a minute. 10 domains a request; DNS only, nothing is emailed.
What are the rua and ruf tags in a DMARC record?
A DMARC record can ask receiving mail servers to send reports back. rua= names where aggregate reports go (daily summaries of who sent mail as your domain and whether it passed), and ruf= names where failure reports go (copies of individual messages that failed). Both take one or more URIs, usually mailto: addresses, and RFC 7489 defines them.
Without a working rua address a domain at p=none collects nothing, which defeats the point of a monitoring policy. A report address that can't receive reports is one of the quietest DMARC mistakes: the record looks fine and nothing ever arrives.
Why do reports to another domain need an authorisation record?
If a report address is on a different domain from the one publishing the record, a receiver is meant to check that the other domain agrees to receive them. RFC 7489 section 7.1 says it does so by looking for a TXT record at <your-domain>._report._dmarc.<their-domain> that starts v=DMARC1. A wildcard record at *._report._dmarc.<their-domain> also works.
This stops a record from pointing a flood of reports at someone who never asked for them. Report services and agencies publish these records for their customers; if you point rua at one and the record is missing, receivers that follow the RFC skip the address and no reports arrive.
What does this check test, and what does it leave alone?
For each mailto: address it reads the domain after the @. If that domain is in a different organisation from the record, it asks for the authorisation record. If it is in the same organisation, it checks for MX records (or an address record, which senders may use as an implicit MX). A !10m size limit on the address is ignored for these tests.
https: report endpoints are listed but not called, so they show as not tested. Nothing is emailed, so the tool can't tell you whether anyone reads the reports, or whether a mailbox's inbox is full. To check the policy itself across a list, use the bulk DMARC checker; for what to do with reports once they arrive, see how to read DMARC aggregate reports.
Who uses this tool, and for what?
- Email administrators
- Confirm that each domain's aggregate reports reach the mailbox or service you set up.
- Agencies and MSPs
- Check every client domain after pointing rua at a reporting service.
- Security teams
- Audit a vendor or subsidiary list for DMARC monitoring that is switched on but broken.
- Deliverability consultants
- Add a report-address column to a DMARC audit and export it as CSV.
What can’t this tool tell you?
- Only DNS is checked. It can't tell whether reports arrive or anyone reads them.
- https report endpoints are not called, so they are listed as not tested.
- Only the first DMARC record is read for the address tests, and a second record is flagged as an error.
- Up to 100 domains a run without an account, 500 signed in.
Common questions
- How do I check DMARC rua addresses for many domains?
- Paste the domains into a bulk DMARC report address checker like this one. It reads each _dmarc TXT record, tests every rua and ruf address and gives a CSV of the results.
- Is this bulk DMARC report address checker free?
- Yes. It is a free tool: up to 100 domains a run with no account, and up to 500 a run when you sign in with Google, with no card.
- Does it send an email to my report address?
- No. It only reads DNS. No message is sent to any address and no https endpoint is called.
- Why do my DMARC reports never arrive?
- The common causes are a report address on another domain with no authorisation record, a typo in the address, an address whose domain has no mail records, and a record published at the wrong name. The row shows which one applies.
- Is a ruf address required?
- No. Many receivers don't send failure reports at all, so most domains publish only rua. This tool tests a ruf address if there is one.
- What if the DMARC record is on the parent domain?
- Receivers fall back to the organisational domain's record for a subdomain with none. This tool reads the record at the name you paste, so paste the domain that publishes it.
Sources
A tidy list can still be full of dead addresses.
Extracting, deduplicating and syntax checks all work on the text of an address. None of them can tell whether the mailbox exists. Only the server that hosts it can answer that, through an SMTP check, and that is what the paid product does.
- Upload the cleaned file as it is: CSVs up to 100,000 rows
- A real SMTP mailbox check on every row, with catch-all detection
- Small list? Starter at $9/mo covers 2,500 emails a month, cancel anytime
Plans from $9 a month, cancel anytime, no contract. Sign in with Google and your first 100 email checks are free, no card. The free tools stay free either way.