DMARC tags reference
A DMARC record is a TXT record at _dmarc.example.com, for example v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com. Check yours or call GET /v1/dmarc?domain=.
| Tag | Values | Notes |
|---|---|---|
v | DMARC1 | Required, must come first. |
p | none, quarantine, reject | Required. none only monitors. |
sp | none, quarantine, reject | Policy for subdomains; defaults to p. |
pct | 0-100 | Share of failing mail the policy applies to. Default 100. |
rua | mailto: URIs | Aggregate reports. A destination on another domain must publish example.com._report._dmarc.<their-domain> (RFC 7489 7.1). |
ruf | mailto: URIs | Failure reports; many receivers don't send them. |
adkim, aspf | r (relaxed), s (strict) | Alignment mode. Default relaxed. |
fo | 0, 1, d, s | Failure reporting options. |
Common mistakes
- Two DMARC records: receivers ignore DMARC entirely.
- Missing
p=, orv=DMARC1not first. - Sending reports to a vendor that hasn't authorized your domain.
- Staying on
p=noneforever: spoofed mail is still delivered.
Source: RFC 7489.