DMARC Record
A DMARC record is a DNS TXT record published at _dmarc.yourdomain.com that tells receiving mail servers how to handle messages that fail SPF/DKIM alignment and where to send aggregate reports.
What a DMARC record looks like
DMARC (RFC 7489) uses a TXT record on the _dmarc subdomain of your organizational domain. Only one DMARC TXT record should exist at that name.
Receivers look up the From domain's DMARC policy before deciding whether to accept, quarantine, or reject unauthenticated mail.
Host: _dmarc
Type: TXT
Value: v=DMARC1; p=none; rua=mailto:[email protected]; fo=1Required and common tags
Start with v=DMARC1. The p tag is required and sets the domain policy. Optional tags control reporting, percentage rollout, and alignment.
- v — protocol version (must be DMARC1)
- p — policy: none, quarantine, or reject
- rua — mailto: URI(s) for aggregate (RUA) reports
- ruf — mailto: URI(s) for failure (RUF) reports (optional)
- adkim / aspf — DKIM/SPF alignment mode (r=relaxed, s=strict)
- pct — percentage of failing mail to apply policy to (default 100)
- sp — subdomain policy when you want different subdomain behavior
- fo — failure reporting options (e.g. fo=1)
| Field | Value |
|---|---|
| Minimal monitoring | v=DMARC1; p=none; rua=mailto:[email protected] |
| Enforcement | v=DMARC1; p=reject; rua=mailto:[email protected]; pct=100 |
Common DMARC record mistakes
Publishing DMARC on the apex (@) instead of _dmarc breaks discovery. Multiple TXT records at _dmarc confuse receivers. Invalid rua URIs (missing mailto:) silently drop reports.
Moving straight to p=reject without monitoring often quarantines or rejects legitimate ESP traffic that is not aligned yet.
- Wrong host name (not _dmarc)
- Two competing DMARC TXT records
- rua without mailto:
- pct=0 left over from testing
- No rua so you never see senders
Microsoft 365 and Google Workspace notes
Neither Microsoft 365 nor Google Workspace publish your organizational DMARC record for you. You add _dmarc at your DNS host (Cloudflare, GoDaddy, Route 53, etc.).
After publishing, verify with a DMARC checker, then authorize M365/Google SPF includes and DKIM selectors so alignment passes before tightening policy.
How QuickDMARC helps
QuickDMARC can host Managed DMARC via CNAME so you change policy without repeated DNS edits, ingest aggregate reports, and guide you from p=none to p=reject.
Frequently asked questions
Where do I put a DMARC record?
Publish a TXT record at _dmarc.yourdomain.com (for example _dmarc.example.com).
Can I have more than one DMARC record?
No. Use a single TXT record at _dmarc. Multiple records can cause inconsistent receiver behavior.
Is rua required?
rua is optional in the spec but essential in practice. Without aggregate reports you cannot safely move to enforcement.