DMARC reports are going to an unauthorized address

Check id: dmarc.external_rua_unauthorized · fix effort: low

What it means

Your DMARC reports are sent to another domain, but that domain never agreed to receive them. Mail providers check for that agreement and quietly drop your reports when it's missing, so you think you're monitoring when you're not.

The technical detail

rua points at an external domain with no authorization record at <yourdomain>._report._dmarc.<reportdomain> (RFC 7489 7.1). Receivers verify this before sending aggregate reports.

How to fix it

1. If you use a DMARC reporting service, use the exact rua address from their setup guide. They publish the authorization for that address.
2. If it's your own second domain, publish a TXT record at <yourdomain>._report._dmarc.<reportdomain> with the value v=DMARC1.
3. Rescan after DNS propagates to confirm reports will flow.