DMARC Record Reference
This article serves as a reference for the formal structure, tags, and key technical details of a DMARC (Domain-based Message Authentication, Reporting & Conformance) record.
DMARC record format
A DMARC record is a special type of TXT record published at the _dmarc subdomain. The record’s format and tags are specified in RFC 9989, which obsoletes RFC 7489.
The value of the TXT record is a single string containing a series of semicolon-separated tags, where each tag is a key/value pair. All DMARC records must begin with the v tag.
Canonical representation:
_dmarc.example.com. IN TXT "v=DMARC1; p=reject; rua=mailto:dmarc@example.com"
In the DNSimple record editor, a DMARC record is represented by the following customizable elements:
| Element | Description |
|---|---|
| Name | The host name for the record, which must be _dmarc. |
| TTL | The time-to-live in seconds. |
| Content | A single string of semicolon-separated DMARC tags. |
DMARC tags and their values
| Tag | Description | Value |
|---|---|---|
v |
Version: Must be the first tag in the record. | DMARC1 |
p |
Policy: The policy for the organizational domain. |
none (monitor only), quarantine (treat as suspicious), reject (block message). |
sp |
Subdomain policy: The policy to apply to subdomains. |
none, quarantine, reject
|
np |
Non-existent subdomain policy: The policy for subdomains that do not exist in DNS. |
none, quarantine, reject
|
rua |
Reporting URI for aggregate reports: An email address to which aggregate reports are sent. | mailto:address@example.com |
ruf |
Reporting URI for failure reports: An email address to which forensic reports are sent. | mailto:address@example.com |
adkim |
DKIM alignment mode |
r (relaxed), s (strict) |
aspf |
SPF alignment mode |
r (relaxed), s (strict) |
fo |
Forensic options: Controls when forensic reports are generated. |
0 (all failures), 1 (any failure), d (DKIM failure), s (SPF failure) |
t |
Testing mode: Asks receivers that support RFC 9989 to apply a softer policy while you test. |
n (default, apply published policy), y (one level softer) |
psd |
Public suffix domain: Indicates whether the record is published for a public suffix domain. |
y, n, u (default) |
Note
RFC 9989 removes the historic pct, rf, and ri tags. Do not use pct for staged rollout. See Implement a Gradual DMARC Policy for the current monitoring-to-enforcement path.
Have more questions?
If you have additional questions or need any assistance with your DMARC records, just contact support, and we will be happy to help. You can also read more about DNS hosting at DNSimple.