Loading Empire…

Skip to content

Learn Fix Tools

Search/

Appearance

Filter problems…

SPF Problems
DKIM Problems
DMARC Problems
DNS & Infrastructure Problems
Delivery Problems
Inbox Placement Problems
Provider Problems
Reputation Problems
Campaign Performance Problems
- High unsubscribe rate
- Low open rate
Warmup Problems

Home
Fix
DMARC Problems
External reporting not authorized

External reporting not authorized

External rua/ruf destinations lack DNS authorization.

Reading time:: 5 min
Difficulty:: Intermediate
Estimated duration:: 5 min
Prerequisites:: None
Last updated:: 2026-07-15
Author:: empire

Problem summary

External rua/ruf destinations lack DNS authorization.

Severity: High

Symptoms

External rua/ruf never receives reports
Receivers skip unauthorized external destinations
DMARC analyzer onboarding incomplete

Possible causes

Missing DNS authorization record at the report receiver domain
Wrong org domain in the authorization hostname
Typo in analyzer-provided DNS name

How to diagnose

Follow the analyzer’s exact DNS authorization instructions
Confirm the authorization TXT/hostname exists and matches your domain

How to fix

Publish the receiver’s required authorization record
Or host rua on a mailbox under your own domain
Re-check after DNS TTL

How to verify

Authorization lookup succeeds
External rua begins receiving aggregates

Prevention

Complete analyzer DNS steps before relying on external rua
Re-validate after domain or analyzer migrations

When to escalate

Production mail is failing for a material share of recipients after remediation attempts

External reporting authorizationDNS authorization required when reports go to another org domain.

DMARC alignment failureSPF/DKIM pass but fail identifier alignment.
DMARC policy not appliedPublished policy is not observed as expected by receivers.
DMARC record missingNo DMARC TXT record exists at the organizational domain.
DMARC reports not arrivingAggregate or failure reports are not received.
Invalid DMARC syntaxDMARC record cannot be parsed by receivers.
Legitimate mail blocked after enforcementEnforcement blocks wanted senders still failing authentication.
Subdomains not protectedSubdomain traffic is outside effective DMARC coverage.
Unknown senders in DMARC reportsReports show sources not yet inventoried or authorized.

MXToolboxPopular DNS and mail diagnostics suite for SPF, DMARC, blacklist, and MX checks.
dmarcian inspectorsDMARC-focused inspectors and educational tooling from dmarcian.
EasyDMARC free toolsFree DMARC/SPF/DKIM lookup and analysis utilities from EasyDMARC.
PowerDMARC free analyzersFree authentication analyzers from PowerDMARC for SPF, DKIM, and DMARC.
LearnDMARCInteractive DMARC learning and inspection helper for operators new to enforcement.
URIports toolsDMARC and related reporting tools for operators collecting aggregate feedback.

PreviousDMARC reports not arriving NextInvalid DMARC syntax

Company

About
Contact
Services

Platform

Learn
Fix
Tools

Community

Empire is a living operator community — share practice, follow releases, and help shape the knowledge base.

Newsletter — coming soon

Legal

Privacy Policy
Terms of Use
Disclaimer
Editorial Policy
Cookie Policy

© 2026 Empire Email

Independent educational platform focused on email infrastructure, deliverability, and lifecycle marketing.