35,050 domains list a DMARC report address without authorization

Your DMARC record can list a reporting address on someone else's domain. Receivers that follow the standard send reports there only when that domain's owner has published a record to authorize it. In our October 2026 scan, 35,050 domains listed an outside address whose owner hadn't.

Is my DMARC record one of them? Run our DMARC checker. It looks up the authorization record for every outside address in your rua= tag.

1. Find your reporting addresses. Run dig +short TXT _dmarc.yourdomain.example and read the rua= tag.
2. Check each address on another domain. For dmarc@reports.example.net, run dig +short TXT yourdomain.example._report._dmarc.reports.example.net. No answer starting with v=DMARC1 means receivers that check, such as Yahoo, send nothing there. In our test, Google and Microsoft sent reports to an address with no authorization record. If Google and Microsoft do the same with your address, your reports go to whoever owns it.
3. Authorize an address you own. If the other domain is yours, publish the record below in that domain's DNS.
4. Replace an address you don't own. If a platform added it or you copied it from a guide, swap it for an address you can read. Leave p= and every other tag as they are.

The authorization check in the standard

Before a receiver sends an aggregate report to an address outside your domain, it should look for a TXT record at yourdomain.example._report._dmarc.<address domain>. A receiver that checks and finds no record drops the report. You get no error and no bounce, so you won't know its reports have stopped.

The rule is in RFC 7489, section 7.1, and RFC 9990, section 4 keeps it. Google's DMARC report help and Microsoft's cross-domain reporting docs both say you need the record.

Our test with a Gmail address

We tested the authorization check for a week in October 2026, on our own domain. Our domain sends little mail. Its DMARC record listed a Gmail address with no authorization record. Google and Microsoft sent reports to it anyway, and Yahoo did not.

Ashiq and others (USENIX Security 2023) found that Google sent reports without the record in their tests too.

Receivers that check send nothing to an address without authorization. If Google and Microsoft do what they did in our test, they send your reports to whoever owns the address. Either way, you don't get the reports.

Gmail inboxes and platform templates lead the list

The table lists the outside addresses we could trace to a platform, a mailbox provider or a setup guide. The first count is every domain whose record lists the address. The second is the domains whose record lists only outside addresses without authorization, so they have no authorized address to fall back on.

Address host	Domains	No authorized address
gmail.com	2,450	2,159
qq.com	858	839
smtp.mailtrap.live	353	311
reporting.unisender.com	282	276
fbl.optin.com	249	212
smtp-staging.mailtrap.net	176	153
lovable.dev	138	107
yourdomain.com	104	102
example.com	92	82

The rest of the 35,050 domains list addresses at other hosts. Across all of them, 30,229 list only outside addresses without authorization, so receivers that check have nowhere to send their reports.

We didn't test any of the addresses below. If Google and Microsoft treat them as they treated our Gmail address, their reports for these domains would go to the owner of each host that accepts mail instead of the domain's owner.

We emailed Mailtrap and Lovable on 2 Oct 2026 to ask whether their setups add these addresses. As of 11 Oct, neither has replied or published the missing records.

Mailtrap shows both of its addresses in its setup guide

The screenshots in Mailtrap's sending-domain setup guide show a DMARC record with smtp.mailtrap.live in it. Another screenshot in the same guide shows smtp-staging.mailtrap.net. Both hosts have Mailtrap mail servers, so Google's and Microsoft's reports for these domains would go to Mailtrap instead of the domain owners.

Unisender's address is the same on every domain

Every domain with a reporting.unisender.com address lists the same one, dmarc@reporting.unisender.com. Unisender is an email marketing service. Google's and Microsoft's reports for these domains would go to Unisender's mail server instead of the domain owners.

optin.com's wildcard answers only one label deep

optin.com publishes a wildcard authorization record at *._report._dmarc.fbl.optin.com. Its nameservers answer it for a made-up name one label deep. A real domain name has at least two labels, and the lookup for one comes back as a name that doesn't exist. Receivers that check send nothing to fbl.optin.com, and Google's and Microsoft's reports would go to optin.com's mail server.

Lovable's docs mention a DMARC record but not this address

Lovable's custom email docs say its setup adds a DMARC record when you turn on "Show as sent from @yourdomain.com". The docs don't print the record, and Lovable hasn't confirmed it adds the lovable.dev address. Google's and Microsoft's reports for the domains that list the lovable.dev address would go to Lovable instead of the domain owners.

Personal Gmail and QQ Mail inboxes have no authorization

An address at gmail.com or qq.com is someone's personal inbox. Google and Tencent publish no authorization records for their users' addresses, so receivers that check won't send reports there.

In our test, a Gmail inbox got the reports from Google and Microsoft. It lost Yahoo's, and it loses those of any other receiver that checks. We haven't tested a QQ Mail address.

Placeholders copied from setup guides

yourdomain.com and example.com are the placeholder names that sample records use. Someone else registered yourdomain.com, and it publishes no authorization records. yourdomain.com accepts mail, so Google's and Microsoft's reports would go to whoever owns it. example.com is reserved for documentation and accepts no mail, so no report sent there arrives anywhere.

Platforms that add an address can fix it once

If your platform puts its own address in customers' DMARC records, publish a wildcard authorization record for that address's domain. Then look up a real customer domain under it, such as customer.example._report._dmarc.reports.example.net. A domain name has at least two labels, and some DNS servers answer a wildcard only one label deep.

If you don't read those reports, stop adding the address, and show customers how to add their own. Leave any address a customer has already added.

How we counted

The numbers come from the October 2026 DMARC Census, our monthly scan of the Tranco top million and the US federal .gov list. For every outside rua= address, the scan looked up the authorization record the way a receiver does.

We counted a failed lookup as unknown. The counts for each host are in the edition's data file, aggregates.json, under CC BY 4.0.

Some of the domains in the table publish p=quarantine or p=reject. Some also list a second address on their own domain or with authorization, and those are in the first count but not the second.

We checked each host in the table by hand, through Cloudflare's and Google's public resolvers and the host's own nameservers, including a probe for a wildcard record. The scan reads DNS, so it can't see whether anyone reads the reports that do arrive.

Get reports at an address that works

DomainCanary gives you a reporting address on our own domain, and we publish the authorization record for every domain that uses it. We read the reports from every receiver and show each server that sent as your domain. Your first domain is free.