Your email reports have an address. Is anyone actually receiving them?

This post is for two people at once: the business owner, and whoever set up their website or email: the web firm, the IT consultant, the digital agency. Read it together, or forward it to the other one. If you only want the short version, jump to the end.

Every day, someone writes you a report

When your business sends email, the big mailbox providers (Gmail, Outlook, Yahoo and others) check that each message really comes from you. Once a day, they can send a summary back: "Here is every server that sent email using your name yesterday. These passed. These failed."

That summary is the only place you can see, for example, that:

• the contact form on your website stopped passing the check last Tuesday;
• your invoices, sent by the accounting software, are landing in spam;
• the ticket system, the ERP, the booking tool or the newsletter was never set up to send properly in your name;
• someone you have never heard of is sending email pretending to be you.

You choose where those reports go. It is one address written in your domain's public settings.

Often, they go to the person who set things up

That makes sense. Your web firm or IT consultant set up your email protection, so they put their address in, to keep an eye on things for you. It was a good idea.

There is a rule almost nobody mentions, though. When the reports go to an address on another company's domain, that other company has to publish a short public note that says "yes, we accept reports for this client." Without that note, the mailbox providers assume the reports are unwanted, and they throw them away.

No error message, no bounce, no warning. The owner thinks someone is watching, and the consultant thinks there was nothing to report. Both are wrong, and neither can know.

This is not about anyone doing a bad job. It is a small rule, buried in the standard, that web and marketing people are simply never taught. In the domains we track, 3,198 send their reports to a company that never published that note. 88 firms receive reports for five clients or more; the biggest, for 64. These are good firms. They just did not know.

What it costs: nothing, until someone complains

When nobody receives the reports, nobody knows what is failing. The contact form, the invoices, the ticket system, the ERP: any of them can be sending email that does not pass, and the first sign is a customer saying "I never got your invoice", or a lead who never heard back.

It gets worse once the domain is set to block fake email, which is the right goal. A tool that was never set up properly is now blocked too, and the report that would have said "it's your own accounting software that's being blocked" goes in the shredder.

And even when everything works today

Say everything passes this morning. Next month the agency changes newsletter platforms, someone edits a DNS setting, or the accounting software moves its servers. Without reports, nobody will know that something in the chain broke. That is why monitoring matters even for a domain that is fine today.

• We explain it in Why DMARC monitoring is important.
• There is also a one-minute video at the top of our pricing page.

If you're the business owner

You don't need to touch anything technical. Two things:

1. Forward this article to whoever set up your website or email, and ask: "Are you actually receiving our email reports?"
2. Check your domain for free. You will see what your domain publishes today.

If you set it up for your clients

The fix goes on your domain, once, and covers every client whose reports point to you. In your DNS, add one TXT record:

*._report._dmarc.yourfirm.com    TXT    "v=DMARC1"

Replace yourfirm.com with the domain in the report address you gave your clients. If your DNS panel won't accept the star, add one line per client instead, with the client's domain in place of the star: client.com._report._dmarc.yourfirm.com.

Check it the way the mail providers do: look up a real client name, for example client.com._report._dmarc.yourfirm.com, and make sure the answer is v=DMARC1. Looking only at the star line is not enough, because some DNS panels save the star as plain text and then it covers nobody.

Then give it a day or two. The reports start arriving, and you finally see what your clients' tools are doing. (The standard calls this an external destination verification record, RFC 7489, section 7.1. You don't need the name, just the line.)

Receiving reports is not the same as reading them. Raw reports are files full of server addresses. If you would rather not spend your mornings on them, we can watch your clients' domains with you: you keep the client, and you earn 35% of what they buy, for as long as they stay. See the partner program.

The short version

1. Your domain's email reports go somewhere. Often to your web firm or IT consultant.
2. If that firm's domain never said "we accept them," the reports are thrown away, and nobody knows that your contact form, invoices or ERP are failing until a customer complains.
3. The fix is one line on the firm's domain, and then someone has to actually watch. Check your domain to start.