Would you find out if someone faked email from your domain?
The DMARC reports check reads whether your DMARC record names an address for aggregate reports. Without one, mail servers have nowhere to tell you about messages that failed in your name.
What does this check look at?
It looks at whether your DMARC record names an address for aggregate reports. The reporting address is the rua part of the record. DMARC tells mail servers what to do with a message that fails those checks, for example put it in spam or reject it, and where to send reports.
Pulse and Deep scans both run it. It reads public records about your domain and never touches your site.
What does a result mean?
| What the report shows | What it means | What to do |
|---|---|---|
| No finding | The record names a report address. | Make sure someone or something reads the reports. |
| Finding | The record names no report address. | Add one. |
A missing report address does not mean anyone is faking your mail, only that you would not hear about it. A clean result means nothing was found in what the scan read. It does not prove the problem is absent from parts the scan never sees.
How serious is a finding?
Treat this as a hardening gap. It makes an attacker’s job easier but gives them no path of its own, so fix it after anything more direct. Confidence starts at medium, because it rests on public records rather than a response from your site. The report lists what to fix by how directly someone could use it, not by the severity label.
What does a confirmed finding have to show?
| Part | For this check |
|---|---|
| Where it starts | Mail sent in your name |
| The protection that should stop it | DMARC names no address for aggregate reports |
| What is reached | Failure reports go nowhere |
| What follows | Spoofing goes unnoticed; no weakness to use on its own |
Which standards does it relate to?
| Standard | Reference |
|---|---|
| OWASP Top Ten | A02:2025 Security Misconfiguration |
| CWE | CWE-345 |
| CWE | CWE-778 |
Each one is a related control, not a verification. A scan sees what anyone online can see, so it never proves a whole requirement is met.
Fix it with your AI
Reports arrive as XML attachments, so a free report reader or a dedicated mailbox makes them usable.
Add aggregate reporting to my domain's DMARC record. Keep the existing policy exactly as it is and add rua=mailto: with an address I will read, or the address of a DMARC report service I choose. Tell me the full record to paste into my DNS settings and how to confirm reports start arriving within a couple of days.How to check
Say Atlas, our example app at atlas.example, publishes DMARC with p=quarantine but no rua address. Fakes are filtered, and nobody at Atlas ever hears about them.
Run a Pulse scan from your Lockpick account to see it for your site. Pulse or Deep explains what each scan reads, and the full list of checks shows the rest.
Questions people ask
Do reports contain the content of my email?
Aggregate reports do not. They list sending sources, counts and whether SPF and DKIM passed.
Can I send reports to an address on another domain?
Yes, but that domain must publish a record saying it accepts reports for yours. Report services set this up for you.
See what your site shows from outside
A quick check reads your homepage the way a visitor would and gives you a score. No account needed.
Check your siteSources
- Email anyone can send Lockpick docs, read on October 7, 2026
- How we rate findings Lockpick docs, read on October 7, 2026