What is my reporting address, and is it safe to publish?

On every plan

The reporting address is where mailbox providers send your domain's reports. Each domain you add gets its own, and it is safe to publish: it takes reports for that domain and its subdomains, and nothing else. It is in the Domains list, and the domain's own page has a button to copy it.

What it looks like

The address is a random token at rep.mailmoni.com. The token is 20 characters long, made of the letters a to z and the digits 2 to 7, and it belongs to one domain only. A report that reaches it can only be filed under that domain.

What it receives

The same address takes all three kinds of report:

• aggregate reports, named with rua= in your DMARC record at _dmarc.example.com;
• forensic reports, named with ruf= in the same record, if you ask for them;
• TLS reports, named with rua= in your TLS-RPT record at _smtp._tls.example.com.

The records the product builds put the address in each of these for you. Report types says what each kind holds.

What it refuses

• Mail to a token we do not hold is refused before the message is sent, with 550 5.1.1. Nothing is stored, and we send no bounce.
• Mail to the address of a domain that is switched off, archived or removed is refused the same way.
• A report about a different domain is skipped, even when it arrives at this address. A report about a subdomain is accepted, and the subdomain appears under its domain.

Why your DNS needs no extra record

A DMARC record that sends reports to an address on another domain works only when that other domain agrees to receive them (RFC 9990, section 3). We publish that agreement once on rep.mailmoni.com, for every domain. You add nothing for it.

Keeping another service's address

You can keep an address from another DMARC service beside ours. The record the product builds keeps every address already in rua= and adds ours after them. RFC 9989, section 4.6, says a mailbox provider should send each report to every address in the list.

The other service has to publish its own agreement for your domain. Until it does, the DMARC check on the domain's DNS tab names the address, and mailbox providers skip it. The check counts this as an error, which holds back readiness until the address is removed or the other service publishes its record.

A limit against floods

The address is public in your DNS, so anyone can send mail to it. When one address has received 500 messages or 200 MiB in the past day, we ask senders to try again later, with 452. Nothing is lost: the sending server keeps the message and delivers it when the count has dropped. A real domain gets about one report a day from each mailbox provider that reports, far below the limit.

Published 27 October 2026 · Checked 27 October 2026