What is a DMARC record?
A DMARC record is a DNS TXT record at _dmarc.yourdomain.com that tells receiving mail servers what to do with messages that fail SPF and DKIM checks for your domain — deliver, quarantine or reject — and where to send reports about who is sending mail in your name.
Why DMARC matters
SPF and DKIM each prove something about a message, but neither is tied to the From address a person sees. DMARC, defined in RFC 7489, adds that link. A message passes DMARC when SPF or DKIM passes and the domain it passed for matches the From domain. That match is called alignment.
Without a DMARC record, anyone can put your domain in the From line and most receivers will deliver it. With one at p=reject, they will not. DMARC is also now a delivery requirement: Google and Yahoo have required a DMARC record from anyone sending 5,000 or more messages a day to their users since February 2024.
How to read the results
| Tag | Meaning | What to look for |
|---|---|---|
p | Policy for the domain | none only monitors. quarantine sends failures to spam. reject blocks them. |
sp | Policy for subdomains | Defaults to p. A weaker sp leaves every subdomain open to spoofing. |
rua | Where aggregate reports go | Without it you get no data and cannot safely tighten the policy. |
ruf | Where failure reports go | Optional. Many receivers no longer send these for privacy reasons. |
pct | Share of failing mail the policy applies to | Anything under 100 is a rollout stage, not a finished setup. |
adkim / aspf | Alignment mode | r (relaxed, the default) allows subdomains. s requires an exact match. |
If the domain you checked is a subdomain with no record of its own, the checker shows the organizational domain's record instead, because that is the one receivers apply.
A safe rollout from p=none to p=reject
- Publish
p=nonewith aruaaddress. Nothing changes for your mail; reports start arriving within a day or two. - Read the reports for two to four weeks. Find every legitimate source — the CRM, the helpdesk, the invoicing system — and fix its SPF or DKIM so it passes with alignment.
- Move to
p=quarantine. Addpct=25first if the volume is large, then raise it. - Move to
p=rejectonce the reports show only mail you do not recognize failing.
_dmarc.example.com. TXT "v=DMARC1; p=none; rua=mailto:dmarc@example.com"_dmarc.example.com. TXT "v=DMARC1; p=reject; rua=mailto:dmarc@example.com"Build either with the DMARC generator.
Common DMARC mistakes this check finds
Two DMARC records. Receivers that find more than one treat the domain as having none. Keep exactly one TXT record at _dmarc.
v=DMARC1 is not first. The version tag must open the record and p must be present, or the record is ignored.
Reports sent to another domain without permission. If rua points at an address on a different domain, that domain must publish a record authorizing it, or receivers will not send the reports:
example.com._report._dmarc.reports-provider.com. TXT "v=DMARC1"This check looks that record up for you. Most reporting providers publish a wildcard, so it usually passes without any action.
p=none left in place for years. It collects reports but stops nothing. If reports are not being read, the record is doing no work.