What Happens When Your DMARC Reporting Domain Expires

The question

What happens when your DMARC reporting domain expires? More specifically: what happens to the email address listed as your DMARC rua destination when the domain it lives on stops being registered?

Short answer: someone else can register that domain, set up an email address that catches your reports, and read everything your DMARC reports contain.

That is a real problem, and it is more common than most people think.

What DMARC reports actually contain

Most people know that DMARC helps filter spoofed email. What fewer realize is that the reports your domain receives from other mail servers are unusually detailed.

A DMARC report includes:

• The IP addresses sending email that claims to be from your domain
• The volume of email sent from those IPs
• Which sending services and cloud providers your domain uses
• Internal infrastructure patterns that emerge from the data
• Failure rates and authentication outcomes for each sending source

This is operational intelligence that most organizations would rather keep private. It is the kind of information an attacker would find useful before launching a BEC campaign or a targeted phishing operation.

How the attack works

The scenario is straightforward:

1. Your organization sets up a subdomain for DMARC reporting, for example: dmarc-reports.yourdomain.com
2. The subdomain is pointed at your mail server or a third-party DMARC service
3. Years pass. The organization does not renew the domain registration for yourdomain.com, or the subdomain is delegated to a service that later loses the domain
4. The domain expires and becomes available for re-registration
5. Someone else registers it, configures an email address at that domain, and begins receiving your DMARC reports

This is not theoretical. A documented case surfaced on Reddit in early 2026: the Global Cyber Alliance had been running a DMARC reporting endpoint for 86 domains. When their service expired, someone else registered the domain and was positioned to collect all incoming reports. The data was not harvested at scale, but the exposure window was real.

Why this keeps happening

Two patterns drive this risk.

First, DMARC reporting addresses are often set up once and forgotten. The team that configured DMARC is not the same team that manages domain renewals. There is no calendar reminder for "check your DMARC reporting endpoint is still registered."

Second, many organizations delegate DMARC reporting to a third-party service that issues its own subdomain for this purpose. If that service shuts down, gets acquired, or simply lets a domain expire, the same problem appears. The organization loses visibility into its own DMARC data, and the domain becomes a liability.

The most reliable fix

The cleanest solution is to use a third-party DMARC service that maintains the reporting infrastructure as part of what they do. DMARCFlow is built around this specifically: the reporting endpoint domain is owned and maintained by the service, not by your organization. Your DMARC record points at their infrastructure, and they handle the domain registration, renewal, and DNS configuration.

The practical benefit is that domain expiry becomes their problem to track, not yours. The DMARC reports still flow to you, but the attack surface of "who owns the reporting domain" shifts to an organization whose core business is staying on top of it.

For organizations with strict data residency requirements, this tradeoff needs evaluating on its own terms. For most organizations, the operational simplicity is worth it.

If you prefer to manage the reporting domain yourself, the alternatives are: use a subdomain under your primary domain (which you are already monitoring for renewal), and set it to auto-renew for the longest available term.

How to check your current exposure

If you already have DMARC configured, audit your setup now:

1. Find your rua tag value in your DMARC DNS record (look for mailto:youraddress@domain.com)
2. Check the domain registration status of that email domain using WHOIS or a DNS lookup tool
3. Verify the MX record for that domain still resolves
4. Confirm you are still receiving aggregate reports on schedule

If any of those checks fail, you have a problem that needs fixing before it becomes an incident.

FAQ

Can I use a subdomain for DMARC reporting instead of the root domain?

Yes, and this is the recommended approach. Use a subdomain like dmarc.yourdomain.com rather than attaching reporting to your root domain. Subdomains can be registered independently and are easier to migrate if your reporting provider changes.

What information exactly do DMARC reports expose?

Aggregate DMARC reports show the IP addresses sending email on behalf of your domain, the volume of mail from each IP, and the results of SPF and DKIM checks. Forensic reports (ruf) can contain individual message headers. Neither report type exposes email content, but the metadata is specific enough to map your sending infrastructure.

Are free DMARC monitoring services safe to use for reporting?

Free services can be useful for initial discovery, but review their data retention policies, privacy terms, and what happens to your data if the service shuts down. A paid service with clear data handling terms is preferable for organizations with security-sensitive environments.

How do I check if my DMARC reporting domain is still active?

Use a WHOIS lookup on your reporting subdomain. Verify the domain is registered, set to auto-renew, and that the MX record for your rua address resolves correctly. If either check fails, investigate immediately.

How often do DMARC reporting domains typically expire?

There is no typical. They expire whenever the organization managing them fails to renew. In our experience reviewing DMARC setups, reporting domains expire for the same reasons any domain expires: oversight, personnel changes, or a mismatch between who manages domains and who manages email security.

Bottom line

Your DMARC reports contain enough operational detail to be worth protecting. When the domain that receives those reports expires, the information becomes accessible to whoever registers it next.

The fix is not complicated. Either control the domain registration yourself and maintain it carefully, or delegate it to a service that treats it as their core responsibility. The risk only materializes when no one is paying attention to the renewal date.