What RUA and RUF means
Both tags take a comma-separated list of mailto: URIs inside a DMARC record: v=DMARC1; p=none; rua=mailto:[email protected]. They carry different things. Aggregate reports, sent to the rua address, arrive about once a day from each reporting receiver as a gzipped XML document counting messages by source address, by SPF and DKIM result and by alignment. Failure reports, sent to the ruf address, are individual redacted copies of messages that failed, in the format of RFC 6591.
Aggregate reporting is what deployments actually run on. Failure reporting is sparsely implemented — the reports carry recipient data, and most large receivers decline to send them for that reason — so a record with ruf= and no rua= collects very nearly nothing.
Sending reports to a domain other than the one being reported on requires that domain's permission, published as a TXT record: example.com._report._dmarc.example.net carrying v=DMARC1 authorises reports about example.com to be sent to example.net. Without it, conforming receivers send nothing, which is the usual explanation for a record that names an external report address and never hears from anybody.
See it on your own domain. Every term in this glossary is something one of the eleven checks reads and reports.
Browse the lookupsKeep reading
Related checks, definitions and guides.
- DMARC The record these tags live in.
- DMARC alignment What the aggregate rows let you see per source.
- DMARC record checker Confirm the tags parse the way you intended.
- Making sense of DMARC aggregate reports Reading the XML and finding the source that fails.
- Taking a DMARC policy to enforcement Using the reports to decide when to move.