At a glance. Record: TXT at _dmarc.yourdomain · Start with: p=none and a rua address · Passes when: SPF or DKIM passes in alignment · End state: p=reject when reports are clean
The short version
- What the policy is. A DMARC record is published as a TXT record at _dmarc on your domain.
- The three policies. With p=none, receivers take no action because of DMARC, and they send you reports.
- Alignment: relaxed and strict. DMARC does not only ask whether SPF or DKIM passed.
- Subdomain policy and pct. The sp tag sets a different policy for subdomains.
- Reports: rua and ruf. The rua tag names where to send aggregate reports.
- A safe rollout. Publish p=none with a report address you will read.
What the policy is
A DMARC record is published as a TXT record at _dmarc on your domain. Its p tag is the policy: it tells receivers what you want them to do with a message that claims to be from your domain and fails the DMARC check.
v=DMARC1; p=none; rua=mailto:dmarc@example.comThe check itself is simple. SPF or DKIM must pass, and the domain that passed must align with the domain in the From address. If neither does, the message fails DMARC and the policy applies.
The three policies
With p=none, receivers take no action because of DMARC, and they send you reports. With p=quarantine, they should treat failing mail as suspicious, which usually means the spam folder. With p=reject, they should refuse the message when it is delivered.
Start with none. It cannot block anything, so it is safe, and the reports it produces show every system that sends as your domain. Move up only when the reports show that your legitimate mail passes.
Alignment: relaxed and strict
DMARC does not only ask whether SPF or DKIM passed. It asks whether the domain that passed is the same organisation as the From domain. With relaxed alignment, which is the default, a subdomain such as mail.example.com aligns with example.com. With strict alignment, the domains must match exactly.
Alignment is set separately for each method with the aspf and adkim tags. A third-party service that signs with its own domain passes DKIM but does not align, so set up your own domain with every sending service.
Subdomain policy and pct
The sp tag sets a different policy for subdomains. Without it, subdomains follow p. It is useful when the main domain is ready to enforce but a few subdomains are not, or when you want to protect subdomains that never send mail.
The pct tag applies the policy to only a share of failing mail. At p=quarantine and pct=10, about a tenth of failing messages are quarantined and the rest are treated as if the policy were one level lower. Raise it in steps as the reports stay clean.
Reports: rua and ruf
The rua tag names where to send aggregate reports. Receivers send them as compressed XML, usually daily, listing the sending IPs, message counts and the SPF and DKIM results. They are the evidence you need before you tighten the policy. The ruf tag asks for failure reports, which many large receivers do not send.
If the report address is on another domain, that domain has to authorise it with a DMARC record at yourdomain._report._dmarc.otherdomain. Reporting services normally set this up for you.
A safe rollout
Publish p=none with a report address you will read. Over the next weeks, list every source in the reports and fix SPF or DKIM for each legitimate one. Then move to p=quarantine with a small pct and raise it, and only then to p=reject.
Expect surprises: a billing system, a forgotten marketing tool, a newsletter service. Each one found at the none stage is a message that would have been lost at reject. Our DMARC generator shows the rollout as a set of records you can copy.
What DMARC cannot do
DMARC protects the exact domain in the From address from being forged. It does not stop lookalike domains, and it does not stop spam that comes from a domain the sender really owns. Forwarding and some mailing lists can also break alignment, which is why large receivers weigh DMARC alongside other signals.
The standard is also being revised at the IETF, so read the current specification when you plan a change.
Further reading and sources
Do it in MigoSMTP: help-center articles
- Read DMARC reports and move to p=reject
- Custom return-path and tracking domains
- Authenticate a sending domain in MigoSMTP: SPF, DKIM and DMARC
Related guides and tools
- DMARC record generator: Build a record and see the rollout.
- SPF, DKIM and DMARC checker: Read your live records.
- How to set up DMARC: The step-by-step setup.
- Fix SPF, DKIM and DMARC failures: Read an error and fix it.
Not sure your records are right? Run our free checker, or send us a header and we will help you read it.
Frequently asked questions
What are the three DMARC policies?
None asks receivers to take no action on mail that fails DMARC, quarantine asks them to treat it as suspicious, usually by filing it as spam, and reject asks them to refuse it during delivery. The policy is set with the p tag.
What is DMARC alignment?
A message passes DMARC when SPF or DKIM passes and the domain that passed matches the domain in the visible From address. Relaxed alignment lets a subdomain match its parent domain. Strict alignment requires an exact match.
What does pct do in a DMARC record?
It sets the percentage of failing mail the policy applies to. It is used to phase in quarantine or reject, for example by starting at 10 and raising it while the reports stay clean.
Does DMARC guarantee that spoofed mail is blocked?
No. The policy is a request that receivers choose to honour, and most large receivers do. Forwarding and mailing lists can also break alignment, so read your reports before you enforce.