← All articles

The DMARC record explained: example to copy and what every parameter means

The DMARC record is a TXT record under _dmarc.your-domain. Three ready-made examples (start, tightening, goal), every parameter explained — p, rua, ruf, pct, sp, adkim, aspf, fo — and the rules records fail on.

7 min read · Updated 7 September 2026

A DMARC record is a TXT record in your domain's DNS under the name _dmarc.your-domain.com. It tells every receiving mail server what to do with messages that fail the SPF and DKIM checks — and where to send reports about them. The smallest useful record has three parts and takes a minute to set:

The parameters one by one

• v=DMARC1 — mandatory, must come first. This is the only version.
• p= — mandatory, the policy for the main domain: none (observe only), quarantine (into the spam folder) or reject (refuse). Must directly follow v=.
• rua= — address(es) for the daily aggregate reports, as mailto:. Separate several addresses with commas. Without rua you never see who sends in your name.
• ruf= — address for individual failure reports (forensic reports). The big recipients (Google, Microsoft) do not send them for privacy reasons — usually omitted.
• sp= — policy for subdomains. If sp is missing, p also applies to all subdomains without their own record.
• pct= — percentage of messages to which quarantine/reject is applied (default 100). Allows gradual tightening, e.g. pct=25.
• adkim= and aspf= — how strictly the domain of the DKIM signature or the SPF must match the sender address: r (relaxed, subdomains count, default) or s (strict, exactly equal).
• fo= — when individual reports are generated: 0 (both fail, default), 1 (either one), d (DKIM fails), s (SPF fails). Only relevant together with ruf.
• ri= — desired reporting interval in seconds (default 86400 = daily). rf= — report format, practically always afrf; omit.

Three ready-made records for the three stages

DMARC is not switched to enforcement in one go, but in stages — whoever sets reject immediately rejects their own forgotten mail. The procedure is in the step-by-step plan; here are the matching records:

What DMARC records fail on

• Two _dmarc records: recipients then evaluate neither. There must be exactly one.
• Wrong name: the record belongs under _dmarc.your-domain.com, not on the domain itself. Some DNS forms swallow the leading underscore — check from the outside after setting.
• p missing or not in second position: the record is invalid, recipients treat the domain as having no DMARC.
• rua pointing to a foreign domain without authorisation: if reports are to go to another domain (e.g. to an analysis service), that domain must publish a TXT record v=DMARC1 under your-domain.com._report._dmarc.other-domain.tld — otherwise the reports are discarded.
• Quotation marks and whitespace: separate tags with semicolons, no line breaks, no typographic quotation marks from word processors.

Checking the record

By hand with nslookup -type=TXT _dmarc.your-domain.com (Windows) or dig TXT _dmarc.your-domain.com. The mailampel domain check additionally rates policy, reporting address and alignment and tells you which stage comes next. What the reports that then arrive contain is explained in Reading DMARC reports.