The RFC requires SMTP servers to first verify that the destination email indeed wants to receive those reports. They’re opt in through a DNS record.

https://datatracker.ietf.org/doc/html/rfc7489#section-7.1