{
 "metric": "dmarc-reporting",
 "segment": "gb-medium-large",
 "anchor": "company",
 "label": "UK medium & large companies",
 "population": "UK medium & large companies",
 "states": [
  "receiving",
  "none_configured",
  "unauthorised"
 ],
 "quiet_failure_states": [
  "none_configured",
  "unauthorised"
 ],
 "measurement": "Tier 0. Read the `rua=` tag from the `_dmarc` TXT record already fetched for `dmarc-policy`. Where a destination mailbox sits on another domain, RFC 9990 requires that domain to publish `<policy-domain>._report._dmarc.<destination>` (or a `*` wildcard at the same name) before a conforming receiver will send anything. Denominator: domains that **have** a DMARC record — a domain with no policy has nothing to report on and is excluded rather than counted as receiving nothing.",
 "why_it_matters": "The reporting half of the p=none story, and the same shape: the record is valid, the checker is green, a reporting address is configured, and not one report has ever arrived. Without the feedback loop nobody ever learns which mail is failing, so the rollout from `none` to `reject` — the thing the policy exists to reach — never starts. `unauthorised` is the quieter of the two: the owner did everything visible correctly and the consent record is on a domain they may not control.",
 "limits": "Aggregate (`rua`) only; `ruf` uses the same consent mechanism but is rarely honoured and is not counted. Reporting is orthogonal to policy strength — a domain can enforce `reject` and still be blind, or sit at `p=none` and receive reports perfectly — so this is not a second reading of `dmarc-policy`. A destination that authorises the domain but silently drops the mail is indistinguishable from one that delivers it; consent is observable from outside, delivery is not.",
 "data_tier": "dns",
 "population_predicate": "has_mx",
 "entity_type": "domain",
 "kind": "failure",
 "latest": {
  "day": "2026-10-01",
  "n": 593,
  "qf_pct": 46.54,
  "ci": [
   42.56,
   50.57
  ],
  "dist": {
   "receiving": 53.46,
   "none_configured": 38.11,
   "unauthorised": 8.43
  },
  "snapshot": "uk-companies-house-per600-seed20260728"
 },
 "series": [
  {
   "day": "2026-09-21",
   "n": 544,
   "qf_pct": 49.08,
   "ci": [
    44.9,
    53.27
   ],
   "dist": {
    "receiving": 50.92,
    "none_configured": 43.38,
    "unauthorised": 5.7
   },
   "snapshot": "uk-companies-house-per600-seed20260728"
  },
  {
   "day": "2026-09-28",
   "n": 546,
   "qf_pct": 48.72,
   "ci": [
    44.55,
    52.9
   ],
   "dist": {
    "receiving": 51.28,
    "none_configured": 43.04,
    "unauthorised": 5.68
   },
   "snapshot": "uk-companies-house-per600-seed20260728"
  },
  {
   "day": "2026-10-01",
   "n": 593,
   "qf_pct": 46.54,
   "ci": [
    42.56,
    50.57
   ],
   "dist": {
    "receiving": 53.46,
    "none_configured": 38.11,
    "unauthorised": 8.43
   },
   "snapshot": "uk-companies-house-per600-seed20260728"
  }
 ],
 "license": "CC BY 4.0",
 "source": "https://quietfailures.com/datasets/dmarc-reporting/gb-medium-large"
}