DMARC Record Reference
Last updated
This article serves as a reference for the formal structure, tags, and key technical details of a DMARC (Domain-based Message Authentication, Reporting & Conformance) record.
DMARC record format
A DMARC record is a special type of TXT record published at the _dmarc subdomain. The record’s format and tags are specified in RFC 9989, which obsoletes RFC 7489 and RFC 9091.
The value of the TXT record is a single string containing a series of semicolon-separated tags, where each tag is a key/value pair. All DMARC records must begin with the v tag.
Canonical representation:
_dmarc.example.com. IN TXT "v=DMARC1; p=reject; rua=mailto:dmarc@example.com"
In the DNSimple record editor, a DMARC record is represented by the following customizable elements:
| Element | Description |
|---|---|
| Name | The host name for the record, which must be _dmarc. |
| TTL | The time-to-live in seconds. |
| Content | A single string of semicolon-separated DMARC tags. |
DMARC tags and their values
| Tag | Description | Value |
|---|---|---|
v |
Version: Must be the first tag in the record. | DMARC1 |
p |
Policy: The policy for the organizational domain. |
none (monitor only), quarantine (treat as suspicious), reject (block message). |
sp |
Subdomain policy: The policy to apply to subdomains. |
none, quarantine, reject
|
np |
Non-existent subdomain policy: The policy for subdomains that do not exist in DNS. |
none, quarantine, reject
|
rua |
Reporting URI for aggregate reports: An email address to which aggregate reports are sent. | mailto:address@example.com |
ruf |
Reporting URI for failure reports: An email address to which message-level failure reports are sent. | mailto:address@example.com |
adkim |
DKIM alignment mode |
r (relaxed), s (strict) |
aspf |
SPF alignment mode |
r (relaxed), s (strict) |
fo |
Failure reporting options: Controls when failure reports are generated. Ignored unless ruf is also set. |
0 (default, report when all authentication mechanisms fail to produce an aligned pass), 1 (report when any mechanism fails to produce an aligned pass), d (DKIM signature failed), s (SPF failed) |
t |
Testing mode: Asks receivers that support RFC 9989 to apply a softer policy while you test. |
n (default, apply published policy), y (one level softer) |
psd |
Public suffix domain: Indicates whether the record is published for a public suffix domain. |
y, n, u (default) |
Note
RFC 9989 removes the historic pct, rf, and ri tags. Do not use pct for staged rollout. See Implement a Gradual DMARC Policy for the current monitoring-to-enforcement path.
Have more questions?
If you have additional questions or need any assistance with your DMARC records, just contact support, and we will be happy to help. You can also read more about DNS hosting at DNSimple.