diff --git a/terraform/dns_operationcode_net.tf b/terraform/dns_operationcode_net.tf
index dd87a0d..70b9fdd 100644
--- a/terraform/dns_operationcode_net.tf
+++ b/terraform/dns_operationcode_net.tf
@@ -62,24 +62,11 @@ resource "aws_route53_record" "net_apex_mx" {
   records = ["0 ."]
 }
 
-# Strict DMARC: reject all spoofed mail, send aggregate reports to tech@
+# Strict DMARC: reject all spoofed mail, no aggregate reports
 resource "aws_route53_record" "net_dmarc" {
   zone_id = aws_route53_zone.operationcode_net.zone_id
   name    = "_dmarc.operationcode.net"
   type    = "TXT"
   ttl     = 3600
-  records = ["v=DMARC1; p=reject; sp=reject; adkim=s; aspf=s; rua=mailto:tech@operationcode.org"]
-}
-
-# DMARC report authorization (RFC 7489 section 7.1)
-# The rua address is in operationcode.org, a different domain than the one being reported on.
-# Receivers only send reports there if the .org zone publishes this record.
-# It lives in this file (not dns_operationcode_org.tf) because it exists only to support the .net DMARC record.
-# It is created in the operationcode.org zone, so it uses that zone's id.
-resource "aws_route53_record" "net_dmarc_report_auth" {
-  zone_id = aws_route53_zone.operationcode.zone_id
-  name    = "operationcode.net._report._dmarc.operationcode.org"
-  type    = "TXT"
-  ttl     = 3600
-  records = ["v=DMARC1"]
+  records = ["v=DMARC1; p=reject; sp=reject; adkim=s; aspf=s"]
 }
diff --git a/terraform/dns_operationcode_org.tf b/terraform/dns_operationcode_org.tf
index 1ae7702..c432e62 100644
--- a/terraform/dns_operationcode_org.tf
+++ b/terraform/dns_operationcode_org.tf
@@ -205,14 +205,18 @@ resource "aws_route53_record" "apex_txt" {
   ]
 }
 
-# DMARC policy for the apex domain (monitoring only, p=none, aggregate reports to tech@)
+# DMARC policy for the apex domain (monitoring only, p=none)
+# Aggregate reports go to Cloudflare DMARC Management (sponsored Cloudflare account, zone operationcode.org).
+# View them in the Cloudflare dashboard: Email > DMARC Management. The rua address comes from
+# `cf email-auth dmarc-reports get -z operationcode.org` (rua_prefix). Cloudflare publishes the
+# cross-domain report authorization record, so no _report._dmarc record is needed here.
 # Next steps: enable Google DKIM, then move to p=quarantine, then p=reject
 resource "aws_route53_record" "apex_dmarc" {
   zone_id = aws_route53_zone.operationcode.zone_id
   name    = "_dmarc.operationcode.org"
   type    = "TXT"
   ttl     = 3600
-  records = ["v=DMARC1; p=none; rua=mailto:tech@operationcode.org"]
+  records = ["v=DMARC1; p=none; rua=mailto:bdc9f1f573b64389b43f1a33b721a77d@dmarc-reports.cloudflare.net"]
 }
 
 # ======================================================================