Troubleshooting

No DMARC reports are arriving

Why a DMARC setup can look finished and receive nothing: the rua= address, the record location, a provider wizard, the 48-hour wait, and what to check in order.

Updated · 2 min read

"Waiting for the first report" and "reports can never arrive" look identical from the outside. Work through these in order; the setup checklist (Monitor, DMARC, Setup) shows the same five steps with their state.

1. Is the plan Starter or higher?

Report intake is Starter and up. On Free the reports are not received and the Email module shows what Starter unlocks. This is a 402 on the API, not a silent failure.

2. Does the DMARC record carry the right rua=?

Run dig +short TXT _dmarc.yourdomain.com (or read the DMARC card). The record must contain rua=mailto:dmarc-<token>@nhmdmarc.com with your account's token, which Monitor, DMARC, Inbox shows. Common problems:

  • A provider's setup wizard published its own DMARC record and replaced yours.
  • The address was rotated (Rotate issues a new one and retires the old) and the record still carries the old token.
  • A typo in the address.
  • The record is at _dmarc.www.yourdomain.com or another subdomain instead of _dmarc.yourdomain.com.

3. Has it been 48 hours?

Receivers send aggregate reports about once a day. The first normally arrives within 24 to 48 hours of publishing the record, and only after some mail from your domain has been received by a reporting receiver (Google, Microsoft, Yahoo). A domain that sends no mail gets no reports; that is correct.

4. Is the authorisation record in place?

Because the report address is on a different domain from yours, receivers require an authorisation record on nhmdmarc.com before sending. DomainGuard publishes it and checks it every five minutes, recording an operational error if it is ever missing. You cannot fix this one; if steps 1 to 3 are fine and it has been more than three days, Ask for help and say so.

5. Did reports arrive and then stop?

The diagnostic (Monitor, DMARC, Diagnostics) has a "reports stopped" finding with the days since the last one. The usual cause is a record change: re-check step 2.

What a working setup looks like

GET /api/dmarc/summary shows a report count and total messages over the last 30 days; the senders list shows Known sources passing and any Unknown ones. From there the two-week / 95% rule decides when to tighten the policy.

Keep reading

Related articles

  1. The domain setup guideThe per-domain checklist computed from what is actually set up: first check, alerts, email records, DMARC reports, ownership proof, monitoring and more.Getting started ·Updated
  2. DMARC reportsThe report address DomainGuard hosts for you, what aggregate reports reveal about who sends as your domain, the 30-day summary, rotation, and alerts.Email authentication ·Updated
  3. Managed email authenticationDelegate your DMARC record to DomainGuard with one CNAME so the policy can be advanced without further DNS edits, and let DomainGuard flatten your SPF.Email authentication ·Updated

Still stuck?

Ask the people who run the scanner.

Send the domain and what you expected to see. We look at the same scan you are looking at and write back with what it means and what to change.

Contact supportCall (330) 305-2750