DMARC record
A DMARC record tells receiving mail servers what to do when a message claiming to be from your domain fails authentication, and where to send reports about it. It's what actually stops other people sending email with your domain in the From address. It's a TXT record at _dmarc.yourdomain that starts with v=DMARC1.
| Record type | TXT (DMARC is a standard carried in TXT records) |
|---|---|
| Lives at | _dmarc |
| Used for | |
| How common | Everyday |
| Defined in | RFC 7489 |
Format
_dmarc <ttl> IN TXT "v=DMARC1; p=<policy>; rua=mailto:<address>"
| Field | What it means | Accepted values |
|---|---|---|
| v=DMARC1 | Marks the record. Must come first. | DMARC1, upper case. |
| p= | The policy for mail that fails. | none (report only), quarantine (spam folder), reject (refuse). |
| rua= | Where to send daily aggregate reports. | mailto: addresses, comma-separated. |
| sp= | A different policy for subdomains. | none, quarantine, reject. Defaults to p. |
| adkim=, aspf= | Alignment: whether the DKIM or SPF domain must match the From domain exactly (s) or may be a subdomain (r). | r (default) or s. |
| pct= | Apply the policy to only this share of failing mail. | 0 to 100, default 100. Being replaced by t= in the updated specification. |
| ruf=, fo= | Per-message failure reports, and when to send them. Few providers send these. | mailto: addresses; fo 0, 1, d, s. |
Build your DMARC record
DMARC record builder
Monitor only. Nothing changes for your mail; you get reports. Start here.
Alignment
| Name | _dmarc |
|---|---|
| Type | TXT |
| Value | v=DMARC1; p=none; rua=mailto:dmarc@example.com; |
In a zone file:
_dmarc 3600 IN TXT "v=DMARC1; p=none; rua=mailto:dmarc@example.com;"
Valid. Paste the name, type and value into your DNS host.
Every part explained
| Part | What it means |
|---|---|
| Textv=DMARC1; p=none; rua=mailto:dmarc@example.com; | 47 bytes. |
| vv=DMARC1 | Marks this as a DMARC record. |
| pp=none | Take no action on failing mail, just report it. The place to start while you check reports. |
| ruarua=mailto:dmarc@example.com | Aggregate reports: daily summaries of who sent mail as your domain. Reports go to dmarc@example.com. If an address is at another domain, that domain must publish a record allowing it (example.com._report._dmarc.otherdomain). |
Check a DMARC record
Type or paste a record in zone-file form (name, TTL, type, value) or just its value. Each part is explained as you type.
A valid TXT record (DMARC policy).
| Part | What it means |
|---|---|
| Name_dmarc | A service name. Underscore names hold records for a protocol (such as _dmarc or _sip._tcp), not a website. |
| TTL3600 | Resolvers may keep this answer for 1 hour before asking again. Changes can take that long to reach everyone. |
| ClassIN | Internet. Every record you'll write uses IN. |
| TypeTXT | Free text: SPF, DKIM, DMARC, verification. |
| Textv=DMARC1; p=quarantine; rua=mailto:dmarc@example.com; adkim=r; aspf=r | 69 bytes. |
| vv=DMARC1 | Marks this as a DMARC record. |
| pp=quarantine | Send failing mail to spam or quarantine. |
| ruarua=mailto:dmarc@example.com | Aggregate reports: daily summaries of who sent mail as your domain. Reports go to dmarc@example.com. If an address is at another domain, that domain must publish a record allowing it (example.com._report._dmarc.otherdomain). |
| adkimadkim=r | Relaxed DKIM alignment (the default): a subdomain of the From domain also counts. |
| aspfaspf=r | Relaxed SPF alignment (the default): a subdomain of the From domain also counts. |
To check the DMARC record a domain publishes right now, use the DMARC checker.
Examples
Start here: monitor
_dmarc 3600 IN TXT "v=DMARC1; p=none; rua=mailto:dmarc@example.com"
Nothing changes for your mail. Reports show every server sending as your domain, so you can fix SPF and DKIM first.
Then quarantine
_dmarc 3600 IN TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com"
Once reports show your real mail passing, failing mail goes to spam.
Full protection
_dmarc 3600 IN TXT "v=DMARC1; p=reject; rua=mailto:dmarc@example.com"
Mail that fails is refused. Required for BIMI logos.
A domain that never sends
_dmarc 3600 IN TXT "v=DMARC1; p=reject;"
With v=spf1 -all, nobody can send as this domain.
How DMARC decides
A message passes DMARC if it passes SPF or DKIM, and the domain that passed matches (aligns with) the domain in the From address people see. SPF checks the hidden envelope sender and DKIM checks the d= in the signature; DMARC is the step that connects either of them to the visible From.
Most mail fails DMARC not because it's fake but because a service sends without your DKIM key or from its own envelope domain. That's why you start with p=none and read the reports.
Reports at another domain
If rua points to an address at a different domain (such as a DMARC reporting service), that domain must publish a TXT record allowing it: example.com._report._dmarc.reportingservice.com with v=DMARC1. Reporting services set this up for you.
Since 2024, a must for bulk senders
Gmail and Yahoo require a DMARC record (at least p=none) from anyone sending more than 5,000 messages a day to their users, along with SPF and DKIM. A DMARC record is a good idea for every domain anyway.
See it on a real domain
TTL
3600. Use 300 while you're moving from none to quarantine to reject. How TTL works
Common mistakes
- Publishing at @ instead of _dmarc. Receivers only look at _dmarc.example.com.
- Going straight to p=reject without reading reports, and blocking your own invoices or newsletters.
- Writing the rua address without mailto:.
- Sending reports to another domain without that domain's authorisation record.
- Two DMARC records at _dmarc. Receivers ignore both.
- Lower-case dmarc1 in the version tag.
At your DNS host
- Name: _dmarc (most dashboards add the domain). Type: TXT.
- Route 53: wrap the value in double quotes.
Questions
What DMARC policy should I use?
Start with p=none and a rua address to collect reports. When the reports show your real senders passing, move to p=quarantine, then p=reject.
Do I need SPF and DKIM for DMARC?
You need at least one of them passing and aligned with your From domain; set up both so mail still passes when one breaks, such as SPF failing on forwarded mail.
Where do I put the DMARC record?
At _dmarc.yourdomain.com, as a TXT record. Subdomains without their own record use the parent's policy (or its sp= policy).
What do DMARC reports contain?
Daily XML summaries from receivers such as Google and Microsoft: which IP addresses sent mail as your domain, how many messages, and whether SPF and DKIM passed. They don't contain message content.
This page is also available as Markdown.
Lemon Domains keeps every domain you own in one place, with expiry reminders, change monitoring and DNS editing from your AI assistant. Get started free