DMARC is one TXT record at _dmarc.yourdomain that tells receivers what to do with mail that fails SPF and DKIM alignment, and where to send reports. Start with a monitoring record, read the reports for a few weeks, fix every legitimate sender that fails, then move to quarantine and reject:
_dmarc.example.com. 3600 IN TXT "v=DMARC1; p=none; rua=mailto:[email protected]"
Before publishing, SPF or DKIM must already work for each service that sends as your domain. DMARC only passes when one of them passes and aligns with the From: domain; see DMARC fails although SPF and DKIM pass. Publish the record and run the DMARC checker to see how receivers will read it.
A note on the standard: this guide cites RFC 7489, the specification receivers have implemented for years. The RFC Editor now marks it as obsoleted by RFC 9989, which, among other changes, removes the pct tag and adds t (test mode) and np (policy for non-existent subdomains). The core tags below work the same way, and unknown tags are ignored by receivers.
Tags
The record is a list of tag=value pairs separated by semicolons. v=DMARC1 must come first and p second (RFC 7489 §6.3).
| Tag | Purpose | Values / default |
|---|---|---|
v | Version; must be the first tag | DMARC1 |
p | Policy for the domain; required | none, quarantine, reject |
sp | Policy for subdomains | same values; defaults to p |
rua | Where aggregate reports go | mailto: URIs, comma-separated |
ruf | Where failure reports go | mailto: URIs; many receivers do not send them |
pct | Percentage of failing mail the policy applies to | 0-100; default 100 |
adkim, aspf | DKIM / SPF alignment mode | r relaxed (default), s strict |
fo | When to generate failure reports | 0 (default), 1, d, s, colon-separated |
Practical notes: sp matters if your marketing mail comes from a subdomain; leave it out to inherit p. ruf reports can contain message content, which creates a privacy question, so most senders publish rua only. Leave adkim and aspf relaxed unless you control every subdomain.
Rollout: none, quarantine, reject
p=nonewithrua: nothing is blocked. Collect aggregate reports for two to four weeks, long enough to see monthly senders such as invoicing.- Fix failing sources: for every legitimate source in the reports, enable custom DKIM or a custom return-path so it aligns. Remove sources you do not recognize.
p=quarantine; pct=10, then raisepctstepwise to 100. Failing mail goes to spam for the sampled fraction. (If a receiver follows RFC 9989,pctis ignored and the full policy applies, so test with a low-risk domain first.)p=rejectonce reports show no legitimate failures. Receivers may refuse failing mail during the SMTP transaction.
Risk of p=reject: it blocks forwarded mail that breaks SPF and mailing-list mail that breaks DKIM, and it blocks any sender you forgot. Staying at p=none is safe but gives no protection against spoofing. Mail rejected before you notice is not redelivered, so move slowly and keep reading the reports after each step.
Receiving reports at another domain
If rua=mailto:[email protected] points outside the domain that publishes the record, the report receiver must authorize it, or senders may drop the address (RFC 7489 §7.1). Publish a TXT record at <yourdomain>._report._dmarc.<receiver-domain> containing v=DMARC1:
example.com._report._dmarc.other.example. IN TXT "v=DMARC1"
If you use a DMARC monitoring service, it tells you the exact rua address. When the report mailbox is on your own domain, nothing extra is needed. Without the authorization record, reports for that destination are normally not delivered, and your mailbox stays empty with no error.
Pitfalls
- Only one DMARC record may exist at
_dmarc; with several, receivers apply no DMARC at all (§6.6.3). - Put the record at
_dmarc.example.com, not the apex. - Check the record after publishing; typos are covered in DMARC syntax errors and how to fix them.
FAQ
Do I need DMARC if I only send a few emails?
Check the requirements of the mailbox providers you send to; some publish DMARC requirements for senders. A p=none record costs nothing and also gives you the reports.
How long until the reports arrive? Receivers typically send aggregate reports once a day, as XML attachments, after they have seen mail from your domain.
Can I set p=reject right away?
You can; the record is valid. The risk is blocking your own forwarded mail and forgotten senders, since you have not yet seen who sends as you.
Sources
- RFC 7489, §6.3 General record format: https://www.rfc-editor.org/rfc/rfc7489#section-6.3
- RFC 7489, §6.6.3 Policy discovery: https://www.rfc-editor.org/rfc/rfc7489#section-6.6.3
- RFC 7489, §7.1 Verifying external destinations: https://www.rfc-editor.org/rfc/rfc7489#section-7.1
- RFC 9989 (obsoletes RFC 7489): https://www.rfc-editor.org/rfc/rfc9989