External DMARC report destination has no authorization record
A DMARC record sends reports outside the organization, but the required authorization TXT record was not found.
Why it matters
Report receivers may discard DMARC reports sent to an external destination that has not authorized them. That can leave monitoring configured but unable to receive reports.
How ShipReady detects it
What it inspects
ShipReady reads DMARC rua and ruf destinations, identifies destinations outside the organizational domain, and queries TXT records at the corresponding authorization names.
What triggers a finding
The rule triggers only when an external destination's authorization lookup resolves and contains no TXT value beginning with v=DMARC1.
What the evidence shows
A scanned DMARC record named an external report destination and the queried authorization name had no matching DMARC authorization value.
Limits of this check
The scanner does not send or receive a DMARC report, validate mailbox delivery, or report an absence when its DNS lookup cannot be completed. It checks a configured authorization record, not the operating status of a reporting service.
How to fix it
Identify who controls the report destination
If it is a reporting provider, complete its domain-verification setup. If it is a domain you control, publish the authorization record there.
Publish the required authorization TXT record
At the external destination domain, publish the sender-specific record specified by DMARC and your provider, with a value beginning v=DMARC1.
How to verify the change
Query the authorization name
Use a DNS lookup after propagation and inspect the reporting service configuration.
Expected: The authorization record resolves with a DMARC value and reports arrive during normal mail volume.