[ Reports & investigation ]
No DMARC reports arriving: trace the collection path
Separate the reporting request, destination permission, mail delivery and ingestion stages before deciding what silence means.
By the EmailAuth research team · 5 min read
[ Key points ]
- Check the effective request and external permission separately.
- Trace receipt through parsing and account mapping.
- An empty graph does not prove no mail or successful authentication.
[ Takeaway ]
An empty graph does not prove no mail or successful authentication.
[ By role ]
What this means for you
Choose your role for practical next steps.
IT / Mail Admin
Trace the chain using one known observation.
Keep the effective policy and report identifiers with receiving and ingestion evidence so the next operator can reproduce the diagnosis.
Next steps
- Check external destination permission.
- Compare raw attachments with processing errors.
- Verify account mapping and the report period.
CISO / SecOps
Treat loss of visibility as an operating incident.
The collection gap changes what the team can observe. Record its duration, affected domains and the limits on conclusions drawn during the gap.
Next steps
- Preserve failed inputs under access controls.
- Assign collection and parser ownership.
- Separate restored telemetry from authentication remediation.
Founder / Non-technical
Ask where the feedback disappeared.
The useful diagnosis identifies a failed stage and an owner, rather than changing DNS until a chart appears.
Next steps
- Confirm who owns the report destination.
- Ask whether reports reached mail delivery or failed later.
- Require a documented restored collection result.
[ FAQs ]
Frequently asked questions
Does a DMARC record automatically request reports?
No. Check the applicable rua request and its actual destination. Policy publication and report collection are different parts of the setup.
Can I prove report delivery with a normal test email?
Only partially. It can demonstrate ordinary mailbox delivery, but report generation, compressed attachments, filtering and ingestion still need their own evidence.
Who publishes an external reporting permission?
The destination operator controls the relevant permission. Confirm the collector's approved configuration and the applicable authoritative DNS answer.
Why can the mailbox contain reports while the dashboard is empty?
Processing can fail after delivery. Trace storage, decompression, namespace and schema handling, deduplication, account mapping and display filters.
Should I change p=reject to p=none when reports stop?
A reporting outage alone is not evidence that the policy caused it. Investigate the failed collection stage before changing an operating policy.
Does silence mean the domain sent no email?
No. Reporting participation, traffic destinations, delivery failures and the selected observation period all affect what is visible.
What can I learn if only one receiver stops reporting?
It narrows the investigation to that reporter's generation or delivery path, participation and observed traffic. It does not establish a complete domain-wide outage.
[ Sources ]
Sources
[ Glossary ]
Glossary
- Aggregate report
- Grouped observations from a reporting receiver for an interval, not a complete sent-mail ledger.
- Alignment
- The required domain relationship between the visible From and an authenticated SPF or DKIM identity.
- Disposition
- Reported DMARC-related handling, distinct from proof of inbox placement.
- Provenance
- The source and processing history retained with an observation.
Enterprise provenance
Why top financial institutions and governments retired their email security dashboards.
Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.
EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.
SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption