Request and recipient consent
03rua identifies aggregate report destinations, and external destinations require verification.
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
DIAGRAM§ 4 ↗
RFC 9990 · § 4EXAMPLE
3 / 3
03
Deliver only when permitted
A missing authorization stops the external reporting path.
Protocol participantThreat or exceptionProtocol controlSimplified drawings · precise section references
Read the updated RFC section ↗
Discover rua from the applicable DMARC policy.
- Discover rua from the applicable DMARC policy.
- Verify external destinations under the defined DNS authorization procedure.
- Do not deliver an unauthorized external report merely because a sender’s policy named it.
Examples are illustrative. Read the exact policy, reporting, and privacy rules in the linked current specification.
Read the RFC section ↗Diagrams simplify the RFC. Read the linked sections for complete requirements.
Privacy