Why DMARC reports silently fail: cross-domain consent and missing MX records

Many domain owners publish valid DMARC records but never receive aggregate reports, often due to two overlooked technical issues. When the rua= address belongs to a different organisational domain, RFC 7489 requires the receiving domain to publish a DNS consent record, without which compliant reporters like Google send nothing. Using a personal Gmail or Outlook address as the rua= destination will never work, since those providers cannot publish authorisation records on a user's behalf. A second common failure occurs on web-only domains that lack an MX record, causing every report to bounce because mail falls back to the domain's A record, which points to a web server rather than a mail handler. Both problems leave the DMARC record itself appearing perfectly valid, making the silence easy to overlook.