---
title: "External Domain Verification for DMARC Reporting and Monitoring | DuoCircle"
description: "The rua and ruf tags in a DMARC record allow domain owners to specify email addresses where they want to receive DMARC aggregate and forensic reports."
image: "https://www.duocircle.com/images/og-default.png"
canonical: "https://www.duocircle.com/blog/dmarc/external-domain-verification-for-dmarc-reporting-and-monitoring/"
---

Quick Answer

External domain verification is a DMARC feature that lets a domain owner receive aggregate (rua) and forensic (ruf) reports at email addresses on a different domain, useful when an organization wants reports separated from primary inboxes or routed to a third-party DMARC service. The verification process: when the receiving server sees the rua/ruf address belongs to a different domain than the sender, it sends a DNS query to the external domain to confirm consent. If the response is positive, reports flow; if not, no reports are sent until the rua/ruf entries are updated. This prevents attackers from redirecting failure reports away from the domain's DMARC team. If verification fails for a legitimate setup, fix it by publishing a TXT record in the external domain's DNS confirming consent. A wildcard DNS record (\* at the leftmost label) is an alternative but is not recommended: it hurts SEO and provides no mechanism to filter incoming reports, opening the inbox to spam.

Share 

[ ](https://www.linkedin.com/sharing/share-offsite/?url=undefined%2Fblog%2Fdmarc%2Fexternal-domain-verification-for-dmarc-reporting-and-monitoring%2F "Share on LinkedIn") [ ](https://twitter.com/intent/tweet?text=External%20Domain%20Verification%20for%20DMARC%20Reporting%20and%20Monitoring&url=undefined%2Fblog%2Fdmarc%2Fexternal-domain-verification-for-dmarc-reporting-and-monitoring%2F "Share on X/Twitter") [ ](https://www.facebook.com/sharer/sharer.php?u=undefined%2Fblog%2Fdmarc%2Fexternal-domain-verification-for-dmarc-reporting-and-monitoring%2F "Share on Facebook") [ ](https://reddit.com/submit?url=undefined%2Fblog%2Fdmarc%2Fexternal-domain-verification-for-dmarc-reporting-and-monitoring%2F&title=External%20Domain%20Verification%20for%20DMARC%20Reporting%20and%20Monitoring "Share on Reddit") [ ](mailto:?subject=External%20Domain%20Verification%20for%20DMARC%20Reporting%20and%20Monitoring&body=Check out this article: undefined%2Fblog%2Fdmarc%2Fexternal-domain-verification-for-dmarc-reporting-and-monitoring%2F "Share via Email") 

![dmarc reporting](https://media.mailhop.org/duocircle/images/2024/01/spf-record-generator-1.jpg) 

The **rua and ruf tags** in a DMARC record allow domain owners to specify email addresses where they want to receive DMARC aggregate and forensic reports. You can choose to receive both types of [DMARC reports](/content/dmarc-report) on the same email address or different ones.

Generally, these email addresses belong to the same custom domain for which the [DMARC record](/resources/dmarc-records) is created. However, you can choose to receive them at an email address outside of the domain’s capacity. This requires the external domain to verify that its **owner has no problem** in receiving these reports. _In most cases, the owner of the domain and the external email address are the same._ Let’s understand this concept in detail.

## What is External Domain Verification?

External domain verification is a DMARC reporting feature that allows domain owners to receive [DMARC aggregate and forensic reports](/resources/dmarc-aggregate-report) on mail servers **outside the domain’s inclusions**. Generally, businesses with several domains and subdomains, intricate email infrastructure, and [third-party service providers](/email-security/things-to-keep-in-mind-when-selecting-the-right-email-security-vendor-for-your-business-domain/) practice it. 

Some parties deliberately create a separate domain to accept such reports so that their **primary inboxes aren’t overloaded** with frequent failure reports. This sorts out operations at different levels. 

[![prevent email fraud](https://media.mailhop.org/duocircle/images/2024/01/office-365-migration-2.jpg)](https://media.mailhop.org/duocircle/images/2024/01/office-365-migration-2.jpg)

## What is the Process of External Domain Verification?

Since you want to receive DMARC reports on an email address belonging to a different domain, you will have to give consent, and this agreement is also verified. External domain verification is important to ensure [hackers](/email-security/hackers-leak-twitter-account-data-putting-235-million-worldwide-at-risk/) don’t misuse this feature to **de-route failure reports** from reaching the inboxes of the person or team in charge of [DMARC](/email/dmarc).

The process starts when the receiving server checks if the email addresses entered next to the [rua and ruf tags](https://blogs.sap.com/2023/02/08/understanding-dmarc-reporting/) have the same domain name as that of the sender. If these are different, the recipient’s server verifies the **consent of the external domain**.

The verification is done by sending [DNS queries](https://www.cloudns.net/wiki/article/254/) to the external domain.

[Servers start sending DMARC reports](https://dmarc.org/2015/08/receiving-dmarc-reports-outside-your-domain/) **if the response is positive**_._ However, if there is no affirmation, no reports are sent to any internal or external domains until email addresses are redefined in the DMARC record. 

_This security exercise ensures that only authorized and trusted users access DMARC reports, which may contain **sensitive details**._

In case you encounter a [temporary DNS timeout error](https://www.dotcom-monitor.com/wiki/knowledge-base/how-to-troubleshoot-dns-errors/#:~:text=If%20DNS%20resolving%20takes%20more,long%20timeout%20that%20was%20terminated.) or similar issues, then you don’t have to take any action. Things would get sorted on their own. However, consider getting in touch with technical experts if issues persist. 

## How to Solve the External Verification Failure?

If the external domain verification process has failed to get consent from a trusted and authorized external domain, then fix this by publishing a [TXT record](https://en.wikipedia.org/wiki/TXT%5Frecord) in the external domain’s DNS. This will help **confirm the consent** or affirmation on behalf of the email address outside of your domain’s capacity. 

## Wildcard Method

Wildcard method is an alternative to the external domain verification process that can be used if there’s a failure in getting a positive response from an authorized email address outside of the domain. A [wildcard record](https://kb.porkbun.com/article/94-what-is-a-wildcard-dns-record) **responds to DNS requests** for subdomains that aren’t defined yet.

A wildcard DNS record is defined using an asterisk or ‘\*’ symbol at the leftmost part of a domain name and allows all subdomains to share the **same web content** with a single DNS entry. 

However, this alternative to the external domain verification method is **not recommended** due to two reasons:

1. It impacts the [SEO ranking](https://www.shopify.com/blog/seo-ranking#:~:text=SEO%20ranking%2C%20or%20search%20engine,to%20increased%20traffic%20and%20visibility.) of your website.
2. As of now, there is **no mechanism to filter reports**, which encourages [cybercriminals](/phishing-protection/10-applications-of-chatgpt-that-hackers-are-already-exploiting/) to [send spam emails](https://www.firstpost.com/explainers/israel-hamas-war-cybercrime-fake-donations-charities-fraud-13293872.html).

## Wrapping It Up

Businesses that experience too many [false positives for outgoing emails](https://debounce.io/glossary/false-positive/) often **create a separate account** for receiving DMARC aggregate and forensic reports; otherwise, their inboxes would get flooded with failure reports, making it challenging to manage other emails. 

[![Email security](https://media.mailhop.org/duocircle/images/2024/01/sendgrid-alternative-7935.jpg)](https://media.mailhop.org/duocircle/images/2024/01/sendgrid-alternative-7935.jpg)

So, if you wish to dedicate an external domain’s email account for the **delivery and management of DMARC reports** then external domain verification method is required to ensure robust [email security](/).

## Topics

DMARCemail securityTrends 

![Brad Slavin](https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg) 

Brad Slavin 

General Manager

General Manager at DuoCircle. Product strategy and commercial lead across the email security portfolio.

## Secure your email infrastructure

Protect, authenticate, and deliver. Contact our team to find the right solution.

[Contact Sales](/contact/) [Explore Products](/products/) 

## Related Articles

[  DMARC 6m  Causes and Solutions of DMARC Failures  Apr 2, 2024 ](/blog/dmarc/causes-and-solutions-of-dmarc-failures/)[  DMARC 3m  DMARC For Shopify Users  Mar 14, 2024 ](/blog/dmarc/dmarc-for-shopify-users/)[  DMARC 8m  How Does DMARC Help Marketers Improving Email Deliverability?  Apr 24, 2024 ](/blog/dmarc/how-does-dmarc-help-marketers-improving-email-deliverability/)[  DMARC 3m  Microsoft’s 000 Reason for Email Failure With DMARC  Mar 5, 2024 ](/blog/dmarc/microsofts-000-reason-for-email-failure-with-dmarc/)

```json
{"@context":"https://schema.org","@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}],"sameAs":["https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://www.facebook.com/duocirclellc","https://www.g2.com/products/phish-protection-by-duocircle/reviews","https://github.com/duocircle","https://www.crunchbase.com/organization/duocircle-llc"],"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://support.duocircle.com"},"knowsAbout":["Email Security","Email Authentication","SPF","DKIM","DMARC","Phishing Protection","Spam Filtering","SMTP Relay","Email Deliverability","Email Forwarding"]}
```

```json
{"@context":"https://schema.org","@type":"WebSite","name":"DuoCircle LLC","url":"https://www.duocircle.com","description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}}
```

```json
[{"@context":"https://schema.org","@type":"BlogPosting","headline":"External Domain Verification for DMARC Reporting and Monitoring","description":"The rua and ruf tags in a DMARC record allow domain owners to specify email addresses where they want to receive DMARC aggregate and forensic reports.","url":"https://www.duocircle.com/blog/dmarc/external-domain-verification-for-dmarc-reporting-and-monitoring/","datePublished":"2024-01-24T18:21:14.000Z","dateModified":"2025-05-08T13:02:13.000Z","dateCreated":"2024-01-24T18:21:14.000Z","author":{"@type":"Person","@id":"https://www.duocircle.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://www.duocircle.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin runs DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. His focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://www.duocircle.com/blog/dmarc/external-domain-verification-for-dmarc-reporting-and-monitoring/"},"articleSection":"dmarc","keywords":"DMARC, email security, Trends","wordCount":657,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/duocircle/images/2024/01/spf-record-generator-1.jpg","caption":"dmarc reporting","width":900,"height":583},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}},{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Blog","item":"https://www.duocircle.com/blog/"},{"@type":"ListItem","position":2,"name":"DMARC"},{"@type":"ListItem","position":3,"name":"External Domain Verification for DMARC Reporting and Monitoring","item":"https://www.duocircle.com/blog/dmarc/external-domain-verification-for-dmarc-reporting-and-monitoring/"}]}]
```

```json
{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://www.duocircle.com/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https://www.duocircle.com/blog/"},{"@type":"ListItem","position":3,"name":"DMARC","item":"https://www.duocircle.comundefined"},{"@type":"ListItem","position":4,"name":"External Domain Verification for DMARC Reporting and Monitoring","item":"https://www.duocircle.com/blog/dmarc/external-domain-verification-for-dmarc-reporting-and-monitoring/"}]}
```

```json
{"@context":"https://schema.org","@type":"BlogPosting","headline":"External Domain Verification for DMARC Reporting and Monitoring","description":"The rua and ruf tags in a DMARC record allow domain owners to specify email addresses where they want to receive DMARC aggregate and forensic reports.","url":"https://www.duocircle.com/blog/dmarc/external-domain-verification-for-dmarc-reporting-and-monitoring/","datePublished":"2024-01-24T18:21:14.000Z","dateModified":"2025-05-08T13:02:13.000Z","dateCreated":"2024-01-24T18:21:14.000Z","author":{"@type":"Person","@id":"https://www.duocircle.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://www.duocircle.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin runs DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. His focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://www.duocircle.com/blog/dmarc/external-domain-verification-for-dmarc-reporting-and-monitoring/"},"articleSection":"dmarc","keywords":"DMARC, email security, Trends","wordCount":657,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/duocircle/images/2024/01/spf-record-generator-1.jpg","caption":"dmarc reporting","width":900,"height":583},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}}
```