Why are Google DMARC aggregate reports not being received?

Key findings

• Sporadic delivery: Google DMARC aggregate reports may cease for certain domains while other mailbox providers continue to send them without issue. This indicates the problem is specific to Google's reporting mechanism or interaction with particular DMARC records.
• No outbound email issues: Often, the lack of DMARC reports is not tied to problems with outgoing email delivery, suggesting the core email flow is unimpacted.
• Multiple RUA addresses: Domains with multiple reporting URI of aggregate (RUA) addresses, especially when one of them is a third-party DMARC service, might experience interruptions.
• Google Workspace hosting: A notable correlation exists where domains hosted on Google Workspace are more likely to stop receiving Google DMARC aggregate reports.

Key considerations

• Check DMARC record syntax: Verify your DMARC DNS record for any subtle syntax errors, including _report._dmarc entries, although Google often sends reports even without external verification. You can learn more about DMARC tags and their meanings.
• Examine RUA addresses: Ensure your RUA addresses are correctly formatted and actively receiving reports. Be aware that the DMARC specification allows verifiers to limit the number of report destinations beyond the minimum two, which could impact delivery if you have many.
• Monitor Google's status: Stay informed about any announcements from Google regarding DMARC reporting or potential pauses. For instance, Google has paused DMARC RUA reports in the past due to various concerns.
• Check email volume: Low email volume from a domain can lead to not receiving DMARC reports, as there might not be enough data to generate one. Consider your sending patterns.
• Investigate internal forwarding: Internal forwarding of emails within a mailbox provider (like Google) can sometimes affect how DMARC reports are generated or attributed.

Key opinions

• Unexpected cessation: Marketers note that Google's DMARC reporting can abruptly stop for domains that previously received consistent reports, without any apparent changes to their DMARC, SPF, or DKIM records.
• No impact on sending: The absence of DMARC aggregate reports from Google does not necessarily mean there are issues with email sending or inbox placement.
• Valimail RUA tag correlation: Some observe a correlation between the cessation of Google reports and the presence of a Valimail RUA tag in the DMARC record, although this is not a definitive cause.
• Google Workspace specific: A recurring observation is that domains hosted on Google Workspace are particularly susceptible to not receiving these reports from Google.

Key considerations

• Verify DNS records: Even if no changes were made, it's crucial to double-check that your DMARC, SPF, and DKIM records are correctly published and free of any syntax issues. Misconfigurations, such as a missing v=DMARC1 tag, can prevent reporting. Our guide on DMARC record and policy examples can help.
• Contact Google support: Directly contacting Google's support team is a viable step, as they may be unaware of specific reporting glitches. Ensure you provide detailed information about the affected domains and the timeline of the issue. You can also consult our guide on how to contact Google Postmaster support.
• Check MTA logs: Confirm that your Mail Transfer Agent (MTA) is configured to accept DMARC report messages and that there are no issues preventing inbound delivery to your RUA addresses.
• Understand internal email routing: Be aware that internal email routing, especially within large platforms like Google GSuite, can sometimes affect how DMARC reports reflect traffic, as noted by Webmasters Stack Exchange.

Key opinions

• Potential Google-side issue: Experts suggest that the problem might be an issue on Google's end, or that Google is suddenly being more strict about minor syntax issues in DMARC records.
• RUA limit possibility: There's a discussion that the DMARC spec allows verifiers to limit the number of RUA destinations, potentially affecting reports for domains with many listed RUA addresses.
• Inconclusive correlation with Valimail: While some domains with Valimail's RUA tag experienced issues, experts found other affected domains without this tag, indicating it's not a universal cause.
• Domain configuration variations: Even with varying DMARC policies (e.g., p=reject vs. p=none) and SPF/DKIM alignment, the absence of Google reports persists, suggesting a broader issue than authentication configuration.
• Intra-Google email bug: The problem might be related to a bug concerning emails exchanged within Google's own network, especially for domains using Google Apps as their MX.

Key considerations

• Examine DMARC policy: Review your DMARC policy, especially the rua and ruf tags, to ensure they are correctly set up and capable of receiving reports. Refer to documentation on DMARC reports for common issues.
• Collaborate and share: Engage with other experts or community forums to share findings and observe if others are experiencing similar issues, as collective data can help identify widespread problems.
• Test with various RUA addresses: Test receiving reports using multiple RUA addresses, including different providers like Google Workspace and Amazon WorkMail, to isolate whether the issue is with a specific recipient or Google's sending.
• Check for SPF/DKIM changes: Although the primary issue might not be authentication, ensure no subtle changes to your SPF or DKIM records could be influencing DMARC evaluation, which might impact report generation. More on common DMARC issues can be found here.

Key findings

• Report content: DMARC aggregate reports are XML files, typically sent daily as a summary of all emails, showing SPF, DKIM, and DMARC authentication results.
• Recipient-side generation: Reports are generated by receiving mail servers (like Google's) based on observed email traffic and then sent to the designated RUA addresses.
• RUA destination limits: While the DMARC specification requires support for at least two RUA destinations, individual verifiers can impose stricter limits, which might affect report delivery if too many addresses are listed.
• Data format: Google typically sends DMARC reports as ZIP files containing an XML file, so issues with decompression or parsing can make them appear garbled or missing.

Key considerations

• Verify DMARC record requirements: Ensure your DMARC record adheres to the latest specifications, including proper placement of v=DMARC1, p, and valid rua addresses. Consult the Zoho Mail glossary on DMARC reports.
• Understand report types: Familiarize yourself with the two main types of DMARC reports, aggregate (RUA) and forensic (RUF), and their purposes, as detailed by Mailjet's guide on DMARC.
• Impact of policy: While a p=none policy still generates reports, stronger policies like p=quarantine or p=reject are increasingly recommended, as discussed by Email on Acid.
• Authentication alignment: Reports rely on SPF and DKIM authentication and alignment. Understanding how these work together is key to interpreting DMARC data, as explained in Mailgun's DMARC implementation guide.