What does rua= mean in a DMARC record?

rua= in a DMARC record sets where receivers send aggregate reports: summaries, in XML, of the mail they saw using your domain and whether it passed SPF, DKIM and DMARC. The value is a mailto: URI, for example rua=mailto:dmarc-reports@example.com. You can list several addresses, separated by commas.

Why it matters

Without a rua address you are publishing a DMARC policy blind. The reports are how you learn which servers send mail as your domain, which of them fail, and when a policy change is safe. They contain counts and sending IP addresses rather than message content. RFC 7489 describes the default reporting interval as 86400 seconds, which is one day, though receivers choose when they actually send.

How to do it

Create a mailbox or alias just for reports, such as dmarc-reports@example.com. Reports can be numerous, so do not use a personal inbox.
Add the tag to your record at _dmarc.example.com:

v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com

For more than one recipient, separate the URIs with commas:

rua=mailto:dmarc-reports@example.com,mailto:reports@example.net

If a report address is on a different domain from the one the record protects, that other domain must agree to receive the reports. RFC 7489 does this with a TXT record at example.com._report._dmarc.example.net whose value is v=DMARC1. Most report-processing services give you the exact record to add.
Wait for the first reports, which usually take a day or more, then open them. They arrive as XML files, often compressed, so a DMARC report viewer makes them readable.

Common mistakes

Writing the address without the mailto: prefix. Receivers will not recognise it as a reporting URI.
Adding spaces inside the value or separating addresses with semicolons. Use commas, and keep the semicolon only between tags.
Pointing reports at a mailbox that does not exist or is full.
Using an address on another domain without the authorising record described above.
Expecting reports instantly. They are batched, so a new record can take time to produce any.

Frequently asked questions

Is rua required?

The RFC does not require it, but without it you receive no aggregate data, so you cannot safely tighten your policy. Treat it as essential.

What is the difference between rua and ruf?

rua requests summary reports covering many messages. ruf requests individual failure reports and is sent by far fewer receivers.

Can I use an https address?

RFC 7489 requires receivers to support mailto: and only allows other schemes as an option. Use mailto: addresses, because that is the form you can rely on.

Want a quick look at your domain's email setup? Try the free website sample.