Sending DMARC reports to another domain (external report authorisation)

Short answer: if your DMARC rua= address is on a different domain from the one the record protects, receivers only send reports there when that other domain publishes a TXT record saying it accepts them. Without it, your DMARC record looks fine but no reports ever arrive.

The symptom

You published DMARC weeks ago, the record is valid, and the reporting mailbox is empty (or only gets reports for some of your domains). This is common when several domains send their reports to one central address, or to a reporting service on the vendor's domain.

_dmarc.shop-example.com. IN TXT "v=DMARC1; p=none; rua=mailto:dmarc@example.com"

Here shop-example.com asks for reports to go to an address at example.com. Those are different organisational domains, so the destination is external.

Why receivers check first

Without a check, anyone could publish a DMARC record that points rua= at someone else's mailbox and get receivers to flood it with reports. So the standard (RFC 7489 section 7.1, carried into the new reporting specification) makes receivers confirm that the destination agreed.

The authorisation record

The destination domain publishes a TXT record built from the domain that sends the reports, then ._report._dmarc., then its own domain:

shop-example.com._report._dmarc.example.com. IN TXT "v=DMARC1"

The record goes in the DNS of the destination (example.com), not the domain being protected.
The value only needs v=DMARC1.
One record per protected domain. To accept reports for every domain, the destination can publish a wildcard, *._report._dmarc.example.com. Reporting services do this, which is why their addresses work without any setup on your side.

Same organisation, different domains

Subdomains do not need this. Reports for mail.example.com sent to dmarc@example.com share the organisational domain example.com, so they are not external. It is needed when you own several separate domains (example.com, example.com.au, example.net) and send all their reports to one of them.

Check it in one step

The DMARC checker lists every rua and ruf address, marks the external ones, and looks up the authorisation record for each. A missing record shows as a problem with the exact name and value to publish.

Other reasons reports do not arrive

The address is missing mailto:, for example rua=dmarc@example.com.
The mailbox rejects large messages. Reports from big receivers are zipped, but can still be several megabytes for busy domains.
Spam filtering on the reporting mailbox quarantines the XML attachments.
You are only looking at one receiver. Some providers send weekly or only once they see enough traffic for your domain.