A typical record
_dmarc.example.com. TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com; adkim=r; aspf=r"See a domain's DMARC record and what it does:
How pass and fail are decided
A message passes DMARC if at least one of these is true:
- SPF passes, and the domain SPF checked matches the From domain.
- DKIM passes, and the domain in the signature (
d=) matches the From domain.
That "matches" is called alignment. In relaxed mode (the default), subdomains count: mail signed by mail.example.com aligns with example.com. In strict mode the domains must be identical.
The usual reason a legitimate message fails isn't a broken signature but a third-party service that signs with its own domain. The fix is to turn on custom-domain DKIM in that service so it signs as you.
Every tag
| Tag | Meaning | Values |
|---|---|---|
v | Version. Required, first | DMARC1 |
p | Policy for the domain. Required | none, quarantine, reject |
sp | Policy for subdomains | Same as p; defaults to p |
rua | Where to send daily aggregate reports | mailto: address(es) |
ruf | Where to send per-message failure reports | mailto: address(es); few receivers send them |
adkim | DKIM alignment | r relaxed (default), s strict |
aspf | SPF alignment | r relaxed (default), s strict |
pct | Share of failing mail the policy applies to | 0 to 100; default 100 |
fo | When to send failure reports | 0 default, 1 any failure, d, s |
ri | Requested report interval | Seconds; default 86400 |
The three policies
p=none
Monitor only. Receivers deliver mail as they normally would and send you reports. This is where everyone should start: the reports show every service sending as your domain, including ones you forgot.
p=quarantine
Failing mail goes to spam or junk. Real mail that you missed still arrives somewhere a user can find it, so this is the safe middle step.
p=reject
Failing mail is refused during delivery and never arrives. This is the goal: it stops people sending convincing phishing as your exact domain.
"DMARC policy not enabled" in a security scan means the domain has no DMARC record or is still at p=none. Mail isn't blocked by that alone, but the domain is easier to impersonate.
Moving safely from none to reject
- Publish
p=nonewith anruaaddress you can read, or a free report service. - Read two to four weeks of reports. Each source sending as your domain shows up with its pass and fail counts.
- Fix every legitimate source that fails: add it to SPF, or turn on custom DKIM in that service.
- Switch to
p=quarantine. If you are nervous, usepct=25first and raise it. - When reports stay clean, switch to
p=reject. - Keep reading reports. New tools that send email appear all the time.
Examples
Start monitoring
v=DMARC1; p=none; rua=mailto:dmarc@example.comEnforce, with stricter subdomains
v=DMARC1; p=quarantine; sp=reject; rua=mailto:dmarc@example.comFull enforcement
v=DMARC1; p=reject; rua=mailto:dmarc@example.comA domain that never sends mail
v=DMARC1; p=rejectPair the last one with v=spf1 -all so nobody can use a parked domain for phishing.
Reports sent to another domain
If the rua address is on a different domain, that domain must publish a record saying it accepts your reports, for example a TXT record at example.com._report._dmarc.reports.example.net containing v=DMARC1. Report services set this up for you.
Keep going
For how DMARC fits with SPF and DKIM, read SPF, DKIM and DMARC explained. Check each record with the SPF, DKIM and DMARC checkers.