Why Google Stops Sending DMARC Reports When GoDaddy Is in the rua Tag

Google aggregate reports go silent. Nothing has changed in the sending infrastructure, the email volume, or the DNS beyond adding a GoDaddy-hosted rua address to the DMARC record. That coincidence usually explains the silence.

What the evidence shows

When any rua address in a DMARC record points to a GoDaddy-managed DNS domain, Google stops sending aggregate reports to every address in that same rua tag. Removing the GoDaddy address restores reporting, sometimes within the same day. Other major receivers -- Microsoft, Yahoo, OpenSIS -- continue normally throughout.

The triggering configuration looks like this:

v=DMARC1; p=none; rua=mailto:reports@yourdomain.com,mailto:dmarc_rua@onsecureserver.net

The onsecureserver.net domain is a GoDaddy-operated DNS hosting platform. The RFC 9091 external destination authorization record on that domain is correctly in place. Google is not reporting an authorization failure -- the record passes validation. Google is choosing not to deliver.

The suppression is silent. There is no error message, no bounce, no indication in the sending infrastructure that anything is wrong. Aggregate reports simply stop arriving from Google's side.

Why Google likely suppresses these reports

Google applies receiver-side policies to DMARC aggregate report delivery that go beyond the RFC minimum. One plausible reason for suppressing reports to GoDaddy-hosted addresses: GoDaddy's onsecureserver.net platform operates both DNS hosting and email marketing services. A rua address on that domain creates a path for aggregate report data to reach an entity that is not the domain owner. Google may treat this as an unintended disclosure risk and suppress delivery to all addresses in the tag rather than risk forwarding aggregate data to a third-party email operator.

This is a receiver policy, not a protocol failure. SPF, DKIM, and DMARC alignment continue to work correctly. Google still evaluates emails and applies the domain's DMARC policy. The only effect is the loss of aggregate report delivery from one receiver.

How to tell if this is happening to your domain

Run a DMARC lookup. The free checker at dmarcflow.com/dmarc-checker inspects a domain's current DMARC record and lists every address in the rua tag.

Look specifically for any address on these domains:

• onsecureserver.net (GoDaddy DNS hosting)


• Any domain using GoDaddy for its authoritative DNS

If a GoDaddy-hosted address is present and Google aggregate reports have gone quiet while Microsoft and others still report, the GoDaddy address is the most likely cause.

How to restore Google DMARC reporting

Option 1: Remove the GoDaddy-hosted rua address

Delete the GoDaddy address from the DMARC record. Keep only your own rua address or a third-party monitoring service address. Google reporting typically resumes within one business day. The trade-off is that any GoDaddy-hosted service relying on that address loses its aggregate visibility.

Option 2: Use a hosted rua service outside the GoDaddy ecosystem

Point the DMARC record at a hosted monitoring service that operates its own infrastructure and is not subject to the Google suppression policy. DMARCFlow provides hosted rua collection on independent servers. Setting up a hosted rua mailbox takes a few minutes and means Google sees a non-GoDaddy destination, which removes the suppression trigger. Configure it at dmarcflow.com/en/wizard.

Option 3: Separate GoDaddy's reporting from the main domain

If GoDaddy is the email service provider and needs its own aggregate reporting, assign GoDaddy's sending domain a separate DMARC record with its own dedicated rua address. This prevents cross-contamination between the main domain's reporting and the provider's.

Why a silent reporting gap is more dangerous than it feels

Aggregate reports are the primary signal for catching domain spoofing, unauthorized senders using your domain, and gradual SPF or DKIM configuration drift. Most phishing and impersonation campaigns spoof the target domain. Without Google aggregate reports, you lose visibility into how the world's largest email receiver evaluates your authentication posture.

A silent gap does not mean nothing is happening. It means the visibility has stopped. Setting up delivery alerts for the DMARC reporting mailbox -- so that a gap in Google reports while Microsoft continues arriving triggers a notification -- catches this faster than waiting for the next manual review.

FAQ

Why does Google suppress DMARC reports for GoDaddy addresses?

Google has a receiver-side policy against delivering aggregate reports to certain third-party DNS hosting domains that also operate email services. This is not an authorization failure. The RFC 9091 record is correct and passes validation. The suppression is silent and receiver-side.

Does this mean my DMARC setup is broken?

No. SPF, DKIM, and DMARC alignment continue to work. Google still evaluates emails and applies your DMARC policy correctly. Only the aggregate report delivery is affected.

How do I check if my DMARC record has a GoDaddy-hosted rua address?

Use a DMARC lookup tool. The free checker at dmarcflow.com/dmarc-checker displays the full DMARC record and every rua address. Look for onsecureserver.net or any domain using GoDaddy for authoritative DNS.

Can I still use GoDaddy's email platform if I remove their rua address?

Yes. Removing the GoDaddy-hosted rua address from the DMARC record does not affect GoDaddy's ability to send email. It only removes their access to aggregate DMARC reports for that domain.

How do I restore Google reporting without losing GoDaddy's own monitoring?

Point the primary DMARC record at a hosted rua service on a non-GoDaddy domain. This keeps Google reporting intact for the main domain. DMARCFlow's hosted rua collection is not subject to the Google-GoDaddy suppression policy and can serve as the primary reporting destination.

Is this documented by Google?

No. Google has not published an official statement on this behavior. It is documented from reproducible field observations across multiple domains and receivers. The policy may change without notice.

---

Google's silence on DMARC reporting is not always a misconfiguration -- sometimes it is a receiver policy silently applied. When the trigger is a GoDaddy-hosted rua address, the fix is usually straightforward: move reporting to an independent host and Google resumes within a day.