DMARC tags
| Tag | Values | Meaning |
|---|---|---|
v | DMARC1 | Required, must come first. |
p | none, quarantine, reject | Required. Policy for the domain. |
sp | none, quarantine, reject | Policy for subdomains; defaults to p. |
pct | 0-100 | Share of failing mail the policy applies to; default 100. |
rua | mailto: URIs | Where to send daily aggregate reports. |
ruf | mailto: URIs | Failure (forensic) reports; few receivers send them. |
adkim / aspf | r, s | Relaxed or strict alignment; default r. |
fo | 0, 1, d, s | When to generate failure reports; default 0. |
Rolling out DMARC safely
- Publish
p=nonewith aruaaddress. - Read aggregate reports for 2-4 weeks and fix any legitimate source that fails SPF/DKIM alignment.
- Move to
p=quarantine(optionally with pct below 100 at first), thenp=reject.
Create a record with the DMARC generator.
Get alerted when it changes
Free daily monitoring re-checks SPF, DKIM, DMARC, MX, BIMI and MTA-STS and emails you when something changes or fails.
Set up free monitoringFrequently asked questions
What does p=none, quarantine and reject mean?
p=none takes no action and only collects reports. p=quarantine asks receivers to treat failing mail as suspicious, usually the spam folder. p=reject asks them to refuse it during SMTP.
What is DMARC alignment?
DMARC passes when SPF or DKIM passes and the domain it authenticated matches the visible From domain. Relaxed alignment (the default, adkim=r / aspf=r) allows subdomains of the same organisational domain; strict (s) needs an exact match.
Do subdomains need their own DMARC record?
No. If a subdomain has no record, receivers use the organisational domain's record, applying sp= if it is set, otherwise p=.
Is p=none enough for Google and Yahoo?
Yes. For bulk senders their 2024 rules require a DMARC record with at least p=none, and the From domain must align with SPF or DKIM.