What is a DMARC record?

[ Quick answer ]

A DMARC record is a TXT record published at _dmarc.yourdomain.com that states your DMARC policy and where to send reports. A minimal example is: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com.

Key facts

›v=DMARC1 and p= are the only required tags; v must come first.
›sp= sets a separate policy for subdomains.
›adkim= and aspf= set strict (s) or relaxed (r, default) alignment.
›pct= applies the policy to a percentage of failing mail (default 100).
›Only one DMARC record is allowed per domain; two records means none is applied.

Reviewed 2026-11-02 · EmailAuth research team

A DMARC record is a single TXT record published in your DNS at the hostname _dmarc.yourdomain.com. It tells receiving mail servers your authentication policy and where to send reports. The record is a list of tags separated by semicolons, and it always begins with v=DMARC1.

Example DMARC record

v=DMARC1; p=reject; rua=mailto:rua@example.com; ruf=mailto:ruf@example.com; adkim=s; aspf=s; pct=100; fo=1

The core DMARC tags

v: protocol version. Always v=DMARC1 and must come first.
p: policy for the domain: none, quarantine, or reject.
sp: policy for subdomains. If omitted, subdomains inherit the p value.
rua: address for aggregate (RUA) reports, written as a mailto URI.
ruf: address for forensic (RUF) failure reports.
adkim: DKIM alignment mode, r for relaxed (default) or s for strict.
aspf: SPF alignment mode, r for relaxed (default) or s for strict.
pct: percentage of failing mail the policy applies to, 1 to 100.
fo: forensic reporting options, controlling when RUF reports are generated.
rf: reporting format for forensic reports, normally afrf.
ri: reporting interval in seconds for aggregate reports, default 86400.

Reading the tags in plain terms

The p tag is the one that does the work: it decides what happens to spoofed mail. The rua tag is where you get value early, because aggregate reports show every source sending as your domain. The adkim and aspf tags control how strictly the authenticated domain must match your From header. Strict alignment is more secure but requires exact domain matches, so most senders keep the relaxed default during rollout.

Publishing the record

1
1. Create the TXT record
Add a TXT record at host _dmarc for your domain with the value starting v=DMARC1.
2
2. Start with monitoring
Set p=none and add your rua address so reports begin flowing without affecting delivery.
3
3. Verify propagation
Query _dmarc.yourdomain.com to confirm the record resolves. A free domain scan from EmailAuth checks this for you.
4
4. Tighten the policy
After confirming legitimate senders pass, raise the policy to quarantine and then reject.

Common mistakes

Publishing more than one DMARC record, which invalidates DMARC entirely. Keep exactly one.
Putting the record at the wrong host. It must be at _dmarc, not the root domain.
Forgetting the rua tag, which leaves you blind to your own sending sources.
Jumping straight to p=reject before authenticating every service, which blocks real mail.

EmailAuth can host your DMARC record by CNAME delegation, so you can update policy and reporting settings without editing DNS each time. It also parses the RUA and RUF data those tags collect into clear dashboards.

Frequently asked questions

Where do I put a DMARC record?

A DMARC record is a TXT record published at the host _dmarc.yourdomain.com. For a subdomain, publish it at _dmarc.subdomain.yourdomain.com. Only one DMARC TXT record is allowed per domain.

What is the minimum valid DMARC record?

The shortest valid record is v=DMARC1; p=none. In practice you should also add a rua address so you receive aggregate reports, for example v=DMARC1; p=none; rua=mailto:rua@example.com.

What does pct do in a DMARC record?

The pct tag applies your policy to only a percentage of failing mail, which is useful for a gradual rollout. For example p=quarantine; pct=25 quarantines a quarter of failing messages. At full protection you set pct=100 or omit it, since 100 is the default.

What is the difference between adkim and aspf?

adkim sets the alignment mode for DKIM and aspf sets it for SPF. Both accept r for relaxed, the default, or s for strict. Relaxed allows the organizational domain to match, while strict requires an exact domain match.