email – How to Remove rua from DMARC DNS Entry or Stop Receiving DMARC Reports

Providers send aggregate reports at varying times. Many come at midnight UTC, but some providers like Microsoft often send hourly reports. Forensic reports come in neartime, usually about 5-10 minutes after the failing message hit the ISP's front end inbound mailers.

You can tell RUA from RUF reports apart pretty easily. An aggregate, or RUA report typically starts like:

--report_section
Content-Type: text/plain;

This is a DMARC aggregate report for yourdomain.com
generated at Mon Mar 23 03:53:50 UTC 2015

while a forensic or RUF report generall starts like:

--61204608-60BE-4D26-9E07-F450C5B0D826
Content-Type: text/plain; charset="US-ASCII"
Content-Transfer-Encoding: 7bit

This is an email abuse report for an email message received from IP 10.10.10.10 on Mon Mar 23 04:01:02 UTC 2015.
The message below did not meet the sending domain's authentication policy.
For more information about this format please see http://www.ietf.org/rfc/rfc5965.txt.

--61204608-60BE-4D26-9E07-F450C5B0D826
Content-Type: message/feedback-report

You will also notice that an RUA report has (often gzipped) XML as an attachment, while the attachment for a RUF report is actual MIME. Few people try to manually read or verify either type of report. Services like Agari and Dmarcian are specifically built to interpret DMARC reporting.

I have finally figured out why I was seeing these DMARC reports about properly signed email sent from my domain.

As I mentioned in the question, my DMARC record was "v=DMARC1; p=none; pct=100; sp=none; rua=mailto:postmaster@example.com;"

By default, Google apps will not deliver emails sent to postmaster@example.com to any of your mailboxes. In order for me to receive these emails I had to create a group with the same name and add myself as a member of this group. This setup step is explained in this Google Apps Help Page.

Turns out however that the email forwarded by the group to my mailbox was counted as an email sent from my domain which meant that I also received a DMARC report for it. This created a feedback loop so I received a DMARC report every day because a DMARC report was forwarded the previous day.

Once I created a new account called dmarc@example.com to accept the DMARC emails and changed my DNS records to "v=DMARC1; p=none; pct=100; sp=none; rua=mailto:dmarc@example.com;" the problem went away.