DMARC Record Reference
This article serves as a reference for the formal structure, tags, and key technical details of a DMARC (Domain-based Message Authentication, Reporting & Conformance) record.
DMARC record format
A DMARC record is a special type of TXT record published at the _dmarc subdomain. The record’s format and tags are specified in RFC 9989, which obsoletes RFC 7489.
The value of the TXT record is a single string containing a series of semicolon-separated tags, where each tag is a key/value pair. All DMARC records must begin with the v tag.
Canonical representation:
_dmarc.example.com. IN TXT "v=DMARC1; p=reject; rua=mailto:dmarc@example.com"
In the DNSimple record editor, a DMARC record is represented by the following customizable elements:
| Element | Description |
|---|---|
| Name | The host name for the record, which must be _dmarc. |
| TTL | The time-to-live in seconds. |
| Content | A single string of semicolon-separated DMARC tags. |
DMARC tags and their values
| Tag | Description | Value |
|---|---|---|
v |
Version: Must be the first tag in the record. | DMARC1 |
p |
Policy: The policy for the organizational domain. |
none (monitor only), quarantine (treat as suspicious), reject (block message). |
sp |
Subdomain policy: The policy to apply to subdomains. |
none, quarantine, reject
|
np |
Non-existent subdomain policy: The policy for subdomains that do not exist in DNS. |
none, quarantine, reject
|
rua |
Reporting URI for aggregate reports: An email address to which aggregate reports are sent. | mailto:address@example.com |
ruf |
Reporting URI for failure reports: An email address to which forensic reports are sent. | mailto:address@example.com |
adkim |
DKIM alignment mode |
r (relaxed), s (strict) |
aspf |
SPF alignment mode |
r (relaxed), s (strict) |
fo |
Forensic options: Controls when forensic reports are generated. |
0 (all failures), 1 (any failure), d (DKIM failure), s (SPF failure) |
t |
Testing mode: Asks receivers that support RFC 9989 to apply a softer policy while you test. |
n (default, apply published policy), y (one level softer) |
psd |
Public suffix domain: Indicates whether the record is published for a public suffix domain. |
y, n, u (default) |
Note
RFC 9989 removes the historic pct, rf, and ri tags. Do not use pct for staged rollout. See Implement a Gradual DMARC Policy for the current monitoring-to-enforcement path.
Have more questions?
If you have additional questions or need any assistance with your DMARC records, just contact support, and we will be happy to help.