External destination verification

What it means

Without a safeguard, anyone could publish rua=mailto:victim@example.net and send failing mail to flood that address with reports. So when the rua or ruf address is in a different organizational domain, receivers look for a TXT record that starts with v=DMARC1 at the policy domain, then _report._dmarc, then the report domain: blue.example.com._report._dmarc.red.example.net.

If the record is missing, the receiver ignores that address. A reporting service that accepts reports for any domain publishes a wildcard, *._report._dmarc.reports.example.net. The authorizing record may also carry its own rua to redirect reports, but only to the same host.

When reports stop arriving after a switch to a new provider, this record is the first thing to check.