The lookup
For a policy at sender.example using a destination at reports.example.net, a receiver constructs a TXT lookup beneath the destination domain.
sender.example._report._dmarc.reports.example.netThe authorisation
A valid record begins with v=DMARC1. Its presence says the report consumer accepts reports for the policy domain. The standard also permits a constrained override URI on the same destination host.
v=DMARC1;How DMARC Analyst uses it
A domain-specific authorisation is provisioned only while the domain is connected to an account. Disconnection disables the unique RUA recipient and removes managed authorisation. The customer should also remove the URI from the source DMARC record.
Some receivers cache DNS results. Stopping all report deliveries may not be instantaneous.
Why one wildcard is not the whole answer
Broad authorisation is operationally simple but makes it harder to withdraw permission for one former customer. Per-domain authorisation provides a clean lifecycle boundary.