DMARCGuardian Practical help for DMARC, SPF, DKIM, and BIMI.

Blog · Dmarc

How to Add Multiple RUA Reporting Addresses to Your DMARC Record

By DMARCGuardian Editorial Team ·

How to Add Multiple RUA Reporting Addresses to Your DMARC Record

You can send DMARC aggregate reports to more than one email address by putting multiple comma-separated mailto: addresses inside a single rua= tag in your DMARC DNS record. There is no separate tag for each recipient.

A basic record with two RUA recipients looks like this:

v=DMARC1; p=none; rua=mailto:reports@example.com,mailto:security@example.com;

That is the entire answer. If that is what you came for, you are done.

If it failed to work, keep reading.

---

Why You Might Need Multiple RUA Recipients

Most domains start with a single RUA address, often a mailbox the IT team monitors. But as DMARC matures, organizations often want reports split across teams:

  • The security team wants aggregate reports to spot spoofing attempts
  • An MSP managing the domain wants their own copy for client reports
  • A compliance inbox needs a record for audit purposes
  • A secondary monitoring tool needs its own feed

All of these can be served from one DMARC record. You just need the syntax right.

---

The Correct DMARC Syntax for Multiple RUA Addresses

The DMARC specification (RFC 7489) defines the rua tag as a comma-separated list of mailto: URI values. Everything lives in a single rua= declaration.

Correct syntax:

v=DMARC1; p=quarantine; rua=mailto:reports@example.com,mailto:security@corp.com,mailto:msp@provider.com;

Common mistakes that break the record:

Mistake 1: Using semicolons between addresses

v=DMARC1; p=none; rua=mailto:a@example.com;rua=mailto:b@example.com;

This is invalid. RFC 7489 does not allow multiple rua= tags, and semicolons separate tags, not addresses within a tag.

Mistake 2: Adding a second rua= tag

v=DMARC1; p=none; rua=mailto:a@example.com; rua=mailto:b@example.com;

Also invalid. Receivers will typically ignore the second rua= tag or return a DNS error.

Mistake 3: Using a non-mailto scheme

v=DMARC1; p=none; rua=https://example.com/dmarc-reports;

Not supported. RUA addresses must be mailto: URIs. Any other scheme will be silently ignored by receivers.

Correct approach:

v=DMARC1; p=none; rua=mailto:a@example.com,mailto:b@example.com;

---

A Working DMARC Record Example With Two RUA Recipients

Here is a complete record with two RUA addresses, a quarantine policy, and alignment requirements:

v=DMARC1; p=quarantine; sp=reject; rua=mailto:dmarc-reports@example.com,mailto:security@example.com; ruf=mailto:dmarc-failures@example.com; pct=100;

Breakdown:


  • v=DMARC1 -- version tag, required

  • p=quarantine -- policy for domains that fail DMARC

  • sp=reject -- subdomain policy

  • rua= -- two comma-separated aggregate report recipients

  • ruf= -- one failure report recipient (also supports multiple addresses using the same comma syntax)

  • pct=100 -- apply policy to 100 percent of messages

You can add more addresses by adding them to the comma-separated list. There is no practical upper limit in the RFC, but receiver limits apply (see below).

---

Common Mistakes That Break DMARC Records With Multiple RUA Tags

Beyond the syntax errors above, here are the most common ways multiple RUA configurations go wrong:

Exceeding the DNS TXT record length

A DMARC TXT record has a practical character limit of around 450-470 characters for the value portion. Each mailto: URI also carries overhead. If you have many RUA addresses with long email addresses, you can hit the limit before you hit the receiver limit.

Watch for this especially when using distribution list addresses, which expand into multiple individual addresses on the receiver side.

URI length limit

Each individual URI within the rua= tag is limited to 254 characters per RFC 3986. Long mailto: links with subject parameters can exceed this.

Percent-encoding confusion

The mailto: URI scheme uses percent-encoding for special characters. If your email address contains non-ASCII characters, percent-encode them. For most standard ASCII email addresses, this is not an issue.

Forgetting the semicolon at the end of the tag

v=DMARC1; p=none; rua=mailto:a@example.com,mailto:b@example.com

The record may still be interpreted correctly in many cases, but the trailing semicolon is standard practice and avoids edge cases.

---

Receiver Limits: Why Some Report Recipients May Not Get Your Reports

Even with valid syntax, receivers decide how many RUA addresses they will honor.

Common receiver limits:


  • Google: accepts up to 5 RUA URIs per domain

  • Microsoft: accepts up to 10 RUA URIs per domain

  • Other receivers: varies, some accept fewer or none

If your record lists 12 RUA addresses and Google receives mail from your domain, Google will send reports to the first 5 addresses listed and silently ignore the rest. The other addresses will never receive Google-sourced reports.

This is not a DMARC specification failure. It is a receiver policy decision.

When you need reports at more addresses than a receiver allows, or when you need reports routed to different teams without managing several inboxes, a DMARC monitoring tool that ingests all RUA streams through a single address solves both problems. You point your rua= at the tool, and the tool handles routing summaries and alerts to the right people. DMARCFlow is purpose-built for this: one RUA address per domain, regardless of how many stakeholders need the data.

---

RUA vs RUF: Multiple Recipients for Each

Both aggregate reports and failure reports support comma-separated multiple addresses using the same syntax.

rua=mailto:a@example.com,mailto:b@example.com;ruf=mailto:c@example.com,mailto:d@example.com;
  • RUA (rua): Aggregate reports, sent periodically (usually daily), compressed XML format. Low volume.
  • RUF (ruf): Forensic failure reports, sent immediately when a message fails DMARC. Can be high volume. Many receivers do not send RUF reports at all.

If you are adding multiple recipients for monitoring purposes, you almost always want RUA. RUF is noisy and not universally supported.

---

How to Verify All Your RUA Addresses Are Receiving Reports

After updating your DMARC record, give it 24-48 hours for receivers to pick up the change. Then check each inbox.

DMARC aggregate reports arrive as compressed XML files (.xml.gz). The sender address in the email will be something like no-reply-dmarc@google.com or @microsoft.com. The subject line typically contains your domain and the word "DMARC".

Signs that a recipient is not receiving reports:


  • No email arrives within 48 hours of the first message hitting the receiver

  • Only some receivers send reports (Google sends reliably, smaller receivers less so)

  • The record shows your domain is sending mail but no reports arrive

If one address is silent while others receive reports, that address may be beyond the receiver limit or the address may be rejecting the report emails.

---

Where DMARCFlow Fits

DMARCFlow handles the multi-stakeholder reporting problem directly. Instead of managing multiple RUA addresses across inboxes, you point your DMARC record at DMARCFlow and let it route the right data to the right team.

For MSPs, this is the practical benefit: one RUA address per client domain, full visibility across the entire portfolio, and alert routing without inbox management.

For in-house teams, it means one place to monitor all your domains instead of spreading report delivery across a handful of mailboxes with no easy way to confirm all of them are actually receiving.

---

FAQ

Can I use multiple rua= tags in one DMARC record?

No. The DMARC specification requires all RUA addresses to be in a single rua= tag, comma-separated. Multiple rua= tags are not valid and will be treated as a malformed record by most receivers.

How many RUA recipients can I add?

There is no DMARC specification limit, but every receiver enforces its own cap. Google accepts up to 5 RUA addresses. Microsoft accepts up to 10. Exceeding a receiver limit means extra addresses are silently ignored. If you need more recipients than a receiver allows, route reports through a single aggregation tool that redistributes.

What is the character limit for a DMARC record?

The practical TXT record value limit is approximately 450-470 characters, depending on your DNS provider. Each individual mailto: URI within the rua= tag is also limited to 254 characters. Long email addresses or addresses with many query parameters can exceed this.

Can I send RUA reports to addresses at different domains?

Yes. The mailto: addresses in your rua= tag can be at any domain. Example:

rua=mailto:team@example.com,mailto:msp@external.com,mailto:compliance@otherdomain.com;

How do I know if all my RUA addresses are actually receiving reports?

After updating the record, wait 24-48 hours and check each inbox for compressed XML report files (.xml.gz) from major receivers. If one inbox is silent while others receive reports, that address may be beyond the receiver URI limit or may be blocking the incoming report emails.

Is there a difference between RUA and RUF for multiple recipients?

Yes. rua= sends aggregate reports (periodic, compressed XML, low volume). ruf= sends forensic failure reports (immediate, per-message, high volume). Both support comma-separated multiple addresses using the same syntax, but you almost always want rua= for routine monitoring. RUF is not universally supported by receivers.