3

G Suite states that one can add a DMARC record with an rua field to get reports about DMARC activity by email:

v=DMARC1; p=reject; rua=mailto:youremail@example.com

But doesn't this basically circumvent WHOIS privacy (where my actual name, address, email etc. are changed) by making my email publicly available via DNS lookups via this DMARC TXT entry?

If I have WHOIS privacy which keeps changing the email on my MX record, what email do I put on here?

  • It also says that rua is optional. – Stephen Ostermiller Jan 26 at 9:14
  • How many users will be using emails on the domain? things like DMARC ain't really required unless you have hundreds of users or sending un-authenicated email or bulk sending, but as Steve said, no need to use RUA. – Simon Hayter Jan 26 at 11:03
  • Unfortunately, I'd like to get reports if emails are getting rejected, so I want to include rua. Is there a way to make it point to the registered email of the domain? – Molten Ice Jan 26 at 11:31
2

You are correct in that it does basically circumvent WHOIS privacy by making the email address you put there public. You have a couple options here:

  1. If your registrar supports email forwarding, create an email forward from a mailbox on your domain - something like rua@example.com - to your real email address. This "facade" email address won't betray any private information.

  2. Use a DMARC monitoring service (there are a couple free ones out there that I could recommend). When you create an account they will give you an anonymized email address on their domain, then they will listen for DMARC report emails and present the results to you in a nice UI.

Unfortunately there is no way to have the DMARC rua aliased to a different part of the WHOIS record, so whatever you put there will need to be hard-coded.

  • A quick google search with "free DMARC monitoring service" gives quite a few good monitoring tools. I think this is the safest way to go about doing this and the right answer in my opinion. Thanks @Maximillian Laumeister! – Molten Ice Jan 28 at 9:23
0

Google's suggestion is just an example. You can theoretically use any email address you like. It should not include your actual name, in my opinion.

Reports that are sent to the rua address contain XML files consisting of, depending on how many emails you send out, many hundreds of lines of email authentication data. And these reports are coming daily, per mailbox hosting provider. It is generally best to automate the flow and visualization of these reports in a tool, specifically built for just that.

So, the email address should not contain a name of an actual person and does not have to be in your registered domain at all. This also makes for a poor email address to send SPAM to, since, most of the time, this email address is not likely to be ever opened by a human. Rather a service that will strip the XML attachments for processing.

Do keep in mind that if you want to have the aggregate reports for domain-x.com sent to rua@domain-y.com, you'll need the owner of domain-y.com to create an additional DNS TXT record: domain-x._report._dmarc.domain-y.com IN "v=dmarc1;", authorizing reporting organizations to send their reports for domain-x.com to a mailbox in domain domain-y.com, as explained here.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.