Determine whether authorization is external

Parse each rua URI and compare the organizational domain of its destination host with the organizational domain that published the DMARC policy. If they differ, RFC 9990 requires the report generator to verify that the report consumer accepts the relationship.

For this illustrative policy:

_dmarc.blue.example.com TXT "v=DMARC1; p=none; rua=mailto:reports@red.example.net"

the receiver constructs a TXT query at:

blue.example.com._report._dmarc.red.example.net

The names are reserved examples. The report consumer publishes a valid DMARC-style authorization record beginning with v=DMARC1 at that name, or uses an intentionally reviewed wildcard for all customers.

Coordinate before changing policy

Confirm the exact policy domain, destination host, mailbox or ingestion endpoint, retention, access, expected volume, and cancellation procedure with the consumer. Some vendors provide account-specific records or override the report URI in the authorization response. Use their current authenticated configuration, not a copied value from another customer.

Publish the consumer-side authorization first. Query its authoritative DNS and a relevant recursive resolver. Then publish or update the policy domain’s rua value and verify both sides.

Keep failure states visible

If the authorization record is absent, malformed, too long to query, or points through a disallowed override, conforming report generators ignore that external URI. A temporary DNS error is not proof that authorization is absent. Because receivers choose whether and when to report, a quiet inbox does not prove that setup works.

Test the intake safely

Use the provider’s documented validation or a controlled domain and normal authorized mail. Confirm that compressed XML is bounded, parsed without external entities or network retrieval, deduplicated, and attributed to its reporter/date range. Monitor rejected attachments and parse failures without exposing report data in logs.

Document both DNS records, owners, TTLs, processor agreement, and offboarding. Removing the authorization can take effect only after cached answers expire. The arrangement is ready when the consumer is verifiably willing, the pipeline safely processes real reports, and missing-report uncertainty is reported honestly.