Skip to content
Webmaster Tools
DNS & domainsDNS LookupDMARC record

DMARC record

How a DMARC record at _dmarc tells receivers what to do with failing mail: p=none, quarantine or reject, alignment, rua and ruf reports, pct, and Gmail and Yahoo rules.

What it is

DMARC (RFC 7489) is a TXT record at _dmarc.<domain> that tells receiving servers what to do with mail claiming to be from your domain when it fails authentication, and where to send reports about it. A message passes DMARC when SPF or DKIM passes and the domain that passed is aligned with the domain in the visible From: header. That alignment is what finally protects the address people actually see.

_dmarc.example.com.  3600  IN  TXT  "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com; adkim=r; aspf=r"

The tags

Tag Meaning Default
v=DMARC1 Version; must be the first tag required
p= Policy: none (monitor only), quarantine (spam folder), reject (refuse) required
sp= Policy for subdomains same as p
rua= Where to send daily aggregate reports (mailto: URIs, comma-separated) none
ruf= Where to send per-message failure reports; few providers send them none
pct= Percentage of failing mail the policy applies to (0-100) 100
adkim=, aspf= Alignment: r relaxed or s strict r
fo= When to send failure reports (0, 1, d, s) 0

Alignment. Relaxed means the domains share the same organisational domain: a DKIM signature with d=mail.example.com aligns with From: news@example.com. Strict requires an exact match. SPF aligns on the Return-Path domain, which is why mail sent through a vendor using its own bounce domain only passes DMARC through DKIM.

Subdomains without their own _dmarc record fall back to the organisational domain's record and its sp= policy.

Common setups

  1. Start with p=none; rua=mailto:... and read the aggregate reports (XML; a report-processing service makes them readable) for a few weeks to find every service sending as you.
  2. Fix SPF and DKIM for each legitimate source.
  3. Move to p=quarantine, optionally with pct= to ramp up, then to p=reject.

A domain that never sends mail can go straight to v=DMARC1; p=reject;.

Gmail and Yahoo (since February 2024). Senders of more than about 5,000 messages a day to their users must have SPF and DKIM, a DMARC record (p=none is enough), a From: domain aligned with SPF or DKIM, one-click unsubscribe for marketing mail, and a spam rate under 0.3%. Every sender needs at least SPF or DKIM.

How to check it

The DMARC checker parses the policy and flags problems; the email authentication check shows it with SPF and DKIM. From a terminal:

dig +short TXT _dmarc.example.com
nslookup -type=TXT _dmarc.example.com

Common mistakes

  • Record at the wrong name. It must be at _dmarc.example.com, not at example.com.
  • More than one DMARC record, which receivers treat as no record at all.
  • Reports to another domain without authorisation. If rua points at reports@vendor.net, that domain must publish example.com._report._dmarc.vendor.net TXT v=DMARC1; report services do this for their customers.
  • Jumping to p=reject without reading reports, which bounces your own invoices or newsletters.
  • Staying at p=none forever. It satisfies the bulk-sender rule but stops no spoofing, and BIMI needs quarantine or reject.