Testing DMARC across multiple domains shows EDV records aren’t strictly required, raising questions about their real enforcement purpose.
.jpg)
Question: Is EDV required for DMARC?
Technically, when setting up DMARC, you need an External Destination Verification record to send DMARC reports to a different domain than the one you're setting the policy for. The EDV record is there to check and make sure the domain getting the reports is allowed to.
I've been investigating this for a couple of months, implementing DMARC in a dozen domains and I've found that not having an EDV record doesn't stop the reports from being sent. This makes me curious about why the EDV record is there and what purpose it serves if things seem to work fine without it.