Why are Google DMARC aggregate reports not being received?

Summary

Google DMARC aggregate reports might not be received due to a combination of factors related to DNS configuration, server settings, authentication issues, and mail volume. Key areas to investigate include: ensuring correct DNS records for reporting permissions, verifying the DMARC record syntax and RUA tag validity, checking the receiving server configuration and capacity, ensuring SPF/DKIM alignment, avoiding multiple redirects in the RUA record, and considering whether low email volume might be preventing report generation. A potential Google-specific issue with Google Apps MX records and internal email traffic should also be considered. It's also possible there's a larger issue with multiple RUAs being impacted.

Key findings

  • DNS Reporting Permissions: Incorrectly configured `_report._dmarc` records can prevent Google from sending reports.
  • Invalid DMARC Record: Incorrect syntax or invalid/unresolvable `rua/ruf` tags in the DMARC record can prevent report generation.
  • Receiving Server Issues: Capacity limitations, misconfiguration, or firewall restrictions on the receiving server can block reports.
  • Insufficient Email Volume: Low email volume may not trigger report generation by Google.
  • SPF/DKIM Alignment: Issues with SPF and DKIM alignment can impact report delivery.
  • RUA Redirection: Multiple redirects or hops in the `rua` record can prevent report delivery by Google.
  • Google Apps MX record: Possible bug relates to intra-Google emails where domain is p=reject and has two URIs in the RUA tag and uses Google Apps as their MX.
  • Multiple RUAs: Domains with multiple RUAs may have issues receiving reports from Google.
  • Deliverability Issues: If Google is not accepting the mail, reports won't be generated.

Key considerations

  • Verify DNS Records: Double-check `_report._dmarc` records in DNS to ensure correct configuration for reporting.
  • DMARC Record Validation: Regularly validate your DMARC record syntax and `rua/ruf` tags to ensure they are correct and resolvable.
  • Server Configuration: Ensure your receiving server is properly configured to accept DMARC reports and has sufficient capacity.
  • Email Volume: Consider that low email volume might result in fewer or no reports.
  • SPF/DKIM Alignment: Verify that SPF and DKIM are properly configured and aligned with your sending domain.
  • RUA Destination: Avoid multiple redirects or hops in your `rua` record to ensure Google can deliver reports.
  • Google Apps Configuration: If using Google Apps, verify that the configuration is not impacting report delivery.
  • Monitor for Broader Issues: Check if multiple domains are affected, as this may indicate a wider problem with reporting.
  • Mail acceptance: Address fundamental deliverability issues that might cause Google to reject mail. Verify Google is accepting emails.

What email marketers say
14Marketer opinions

DMARC aggregate reports from Google might not be received due to several reasons. The most common include misconfigured DMARC records (invalid syntax, incorrect or unresolvable `rua` tags), issues with the receiving server (capacity problems, incorrect configuration, firewall blocks), insufficient email volume, problems with SPF/DKIM alignment, the presence of multiple redirects in the RUA record, or a Google-specific issue related to Google Apps MX records. Some issues can be wider than just one domain, related to the server set up or internal google issues.

Key opinions

  • Misconfigured DMARC record: Incorrect syntax or invalid/unresolvable `rua` tags can prevent report generation.
  • Receiving Server Issues: Capacity limitations, misconfiguration, or firewall restrictions on the receiving server can block reports.
  • Insufficient Email Volume: Low email volume may not trigger report generation.
  • SPF/DKIM Alignment: Issues with SPF and DKIM alignment can impact report delivery.
  • RUA Redirection: Multiple redirects or hops in the `rua` record can prevent report delivery.
  • Google Apps MX record: Behavior seen with one domain, which is p=reject and has two URIs in the RUA tag and uses Google Apps as their MX, indicating a possible bug related to intra-Google emails.
  • Domains with multiple RUAs: Can impact report delivery from Google and may indicate a wider issue.

Key considerations

  • DMARC Record Validation: Regularly validate your DMARC record syntax and `rua` tags to ensure they are correct and resolvable.
  • Server Configuration: Ensure your receiving server is properly configured to accept DMARC reports and has sufficient capacity.
  • Email Volume: Understand that low email volume might result in fewer or no reports.
  • SPF/DKIM Alignment: Verify that SPF and DKIM are properly configured and aligned with your sending domain.
  • RUA Destination: Avoid multiple redirects or hops in your `rua` record to ensure Google can deliver reports.
  • MX Record: Ensure that your MX Record is correctly set up in order for google to successfully send through DMARC reports.
Marketer view

Email marketer from StackOverflow User responds that issues can be caused by invalid DMARC syntax, which is a common problem. Check for common errors like semicolons, spaces, and typos.

March 2021 - StackOverflow
Marketer view

Marketer from Email Geeks updates that the behavior is seen with one domain, which is p=reject and has two URIs in the RUA tag and uses Google Apps as their MX, indicating a possible bug related to intra-Google emails.

October 2022 - Email Geeks
Marketer view

Email marketer from Mailhardener explains that if DMARC aggregate reports aren't received, it could be due to a misconfigured DMARC record, issues with the receiving email server, or the sending domain not having enough email volume to trigger report generation.

April 2021 - Mailhardener
Marketer view

Marketer from Email Geeks asks if anything is different with the records on the affected domains (e.g., pct tags) and suggests verifying that the issue isn't related to the MTA not accepting the report messages.

March 2023 - Email Geeks
Marketer view

Email marketer from Agari shares that if a domain does not have any mail flow or is newly configured, Google may not send DMARC aggregate reports. Additionally, if a RUA is managed by a third-party provider, they may have blocked reporting from that domain.

November 2021 - Agari
Marketer view

Email marketer from Postmark shares that the two primary reasons you are not receiving reports are because of the DMARC record being incorrect or there is an issue with the receiving server.

April 2024 - Postmark
Marketer view

Email marketer from EmailGeekly explains one of the main reasons for not receiving reports from Google is due to having multiple redirects and/or hops in the RUA record. Google is very sensitive about this and has issues sending to RUA's that aren't immediately resolvable.

April 2021 - EmailGeekly
Marketer view

Marketer from Email Geeks explains that one of the domains that is not recieving reports from google has p=reject and has 100% SPF and DKIM alignment, one is p=none and has 5% SPF and 100% DKIM alignment.

July 2022 - Email Geeks
Marketer view

Email marketer from Reddit suggests that the issue may be with the receiving server's configuration. This can include capacity issues on their server, incorrect setup for the DMARC reporting recipient, or issues related to firewalls and security protocols.

April 2022 - Reddit
Marketer view

Marketer from Email Geeks asks if differences in DKIM or SPF configurations might be causing an issue with evaluation and the lack of reports.

April 2022 - Email Geeks
Marketer view

Email marketer from MXToolbox explains that DMARC is a DNS record that specifies how email receivers should handle messages that fail SPF or DKIM checks. One of the first troubleshooting steps is to make sure the syntax of the record is correct and that the destination server specified in the RUA tag accepts DMARC reports.

May 2021 - MXToolbox
Marketer view

Email marketer from Email Deliverability Forum explains that the amount of email you send impacts whether or not you receive DMARC reports. If you are only sending a small amount of emails, or your emails are being classified as spam, the receiving server may not trigger a DMARC report.

July 2021 - Email Deliverability Forum
Marketer view

Email marketer from EasyDMARC shares that invalid `rua` or `ruf` tags in the DMARC record will cause reports to not be generated. Common mistakes can be using a non-email address in the tag, using an unresolvable domain in the tag, or using an email address to which you do not have access to verify proper DMARC record usage.

May 2021 - EasyDMARC
Marketer view

Marketer from Email Geeks notes they have found at least two domains with multiple RUAs (including themselves) that do not appear to be receiving Google aggregate reports, suggesting it might be a wider issue.

November 2022 - Email Geeks

What the experts say
6Expert opinions

Based on expert opinions, Google DMARC aggregate reports might be missing due to misconfigured DNS reporting permission records, potential deliverability issues causing Google to reject mail, exceeding the allowed number of report destinations, or Google not sending reports for low-volume mail streams. Correctly setting up the RUA is also crucial for receiving reports.

Key opinions

  • DNS Reporting Permissions: Incorrectly configured `_report._dmarc` records can prevent Google from sending reports.
  • Mail Acceptance: If Google isn't accepting mail, this suggests a fundamental deliverability problem.
  • Report Destination Limits: DMARC verifiers might limit the number of report destinations, potentially preventing report delivery if too many are specified.
  • Low-Volume Mail: Google might not generate reports for low-volume mail streams, according to unknown criteria.
  • Incorrect RUA Setup: Failure to configure RUA correctly leads to not being able to receive reports.

Key considerations

  • Verify DNS Records: Double-check `_report._dmarc` records in DNS to ensure correct configuration for reporting.
  • Deliverability Checks: Investigate and resolve any potential deliverability issues that might cause Google to reject mail.
  • Limit Report Destinations: If possible, reduce the number of report destinations in the DMARC record to stay within potential limits.
  • Email Volume: Consider if low email volume is the reason why reports are not being sent by Google.
  • Setup RUA Correctly: Review the set up of your RUA and fix any mistakes that may occur.
Expert view

Expert from Email Geeks explains the dmarc verifier is allowed to limit the number of report destinations above the spec-required minimum of two, so it could be the reason the DMARC aggregate reports are not being recieved.

November 2023 - Email Geeks
Expert view

Expert from Word to the Wise explains the importance of setting up the RUA correctly and the risks of missing reports due to bad configuration.

June 2024 - Word to the Wise
Expert view

Expert from Email Geeks asks if Google is accepting the mail, implying a potential deliverability issue.

January 2023 - Email Geeks
Expert view

Expert from Email Geeks asks if the DMARC specification has a limit on the number of places reports can be sent, referencing a recent discussion on the topic.

June 2023 - Email Geeks
Expert view

Expert from Spam Resource explains that a possible cause could be Google not sending reports because the volume of mail sent does not meet some unknown criteria Google has for report generation.

September 2022 - Spam Resource
Expert view

Expert from Email Geeks suggests checking that the reporting permission records are correctly in place in DNS (`_report._dmarc` stuff) for the domains not working, especially if handling is done internally.

June 2024 - Email Geeks

What the documentation says
4Technical articles

According to technical documentation, Google DMARC aggregate reports are not received due to a combination of factors. These include misconfigured receiving servers, deliverability problems, DNS errors, syntax errors in DMARC records, spam filtering blocking, size limitations on receiving servers, domain policies preventing third-party reporting, and insufficient authentication/alignment of SPF/DKIM with the From address domain.

Key findings

  • Misconfigured Server: Receiving server issues prevent report delivery.
  • DNS/Syntax Errors: DNS and Syntax Errors can prevent DMARC reports being generated.
  • Blocked Reports: Spam filters or size limits on receiving servers may block reports.
  • Domain Policy Restrictions: Receiving domain policies can prevent reporting to third parties.
  • Authentication Failures: Lack of SPF/DKIM alignment can suppress report generation.

Key considerations

  • Server Configuration: Ensure receiving servers are correctly configured to accept reports.
  • DMARC Record Review: Correct DNS and syntax of your DMARC record.
  • SPF/DKIM Alignment: Properly align SPF/DKIM authentication with the From address domain.
  • Report Restrictions: Be aware of receiver policies related to delivery of DMARC reports.
Technical article

Documentation from Microsoft explains DMARC relies on the alignment between the domain used in the From address and the domain used for SPF or DKIM authentication. If these domains do not align, or if SPF and DKIM checks fail, then the receiving mail server may not trigger DMARC reports.

January 2023 - Microsoft
Technical article

Documentation from DMARC.org shares that common reasons for not receiving DMARC reports include DNS configuration errors, syntax errors in the DMARC record, or the receiving mail server blocking the reports due to spam filtering or size limitations.

August 2023 - DMARC.org
Technical article

Documentation from RFC 7489 explains that DMARC aggregate reports might be suppressed if the receiving domain's policy prevents the sending of reports to third parties, or if the sending domain doesn't have sufficient authentication or alignment.

June 2023 - RFC Editor
Technical article

Documentation from Google Workspace Admin Help explains that DMARC reports might not be delivered if the receiving server is misconfigured or has deliverability issues. The DMARC record's `rua` tag must point to a valid and accepting mailbox.

December 2022 - Google Workspace Admin Help