You published a DMARC record with rua=mailto:dmarc@yourdomain.com, a week passes, and the mailbox is empty. Before assuming nobody is sending mail as you, check the five usual causes.

1. The record has a syntax problem

Receivers silently ignore a malformed DMARC record. Common culprits:

  • Two TXT records at _dmarc.yourdomain.com (only one is allowed; with two, evaluation is skipped).
  • A missing semicolon: v=DMARC1; p=none rua=mailto:... (no ; after p=none).
  • Smart quotes pasted from a document, or a record split into strings that a DNS UI joined with a stray space. 
dig +short TXT _dmarc.yourdomain.com

You should see exactly one line starting "v=DMARC1;".

2. The report address is on another domain

If rua points at reports@other-domain.example, receivers will only send there if other-domain.example publishes an authorization record:

yourdomain.com._report._dmarc.other-domain.example. TXT "v=DMARC1"

Without it, compliant receivers drop the report. This is the most common reason third-party report inboxes stay empty.

3. The mailbox rejects them

Aggregate reports arrive as zipped or gzipped XML attachments, often 20 KB to several MB, from addresses such as noreply-dmarc-support@google.com. A shared mailbox with an attachment filter, a size cap, or a spam rule will bounce or quarantine them. Check the quarantine, not just the inbox.

4. Volume is low or the wait is too short

Google and Microsoft send roughly once per 24 hours, and only if they saw mail claiming your domain that day. A parked domain or a tiny sender may get nothing for days. Send a test message to a Gmail address and wait 48 hours before concluding something is broken.

5. You are watching for ruf, not rua

ruf= (forensic reports) is rarely honored by large providers. If you were waiting for per-message failure samples, they will mostly never come. Aggregate rua is the one that works.

What the reports should show once they flow

For a healthy setup, nearly every source IP should show SPF or DKIM aligned to your From domain. A source you do not recognise passing nothing is either forgotten software or spoofing; that is the signal you move toward p=quarantine on, not before.

The point of the record is not publishing it once. It is reading what comes back, every week, because senders get added and keys rotate without anyone telling DNS.