🛡️ DMARC Tags Reference

A DMARC record is a DNS TXT record published at _dmarc.yourdomain.com. It consists of key=value tags separated by semicolons. All DMARC record tags as defined in RFC 9989 (DMARCbis) and its predecessor RFC 7489 are covered here, with valid values, defaults, and what each one actually controls. RFC 7489 has been replaced by RFC 9989, 9990, and 9991 as IETF Proposed Standards. For an overview of what changed in the revision, see DMARCbis (DMARC 2.0).

Minimal vs. Full DMARC Record

Minimum (monitoring only)
v=DMARC1; p=none; rua=mailto:[email protected]
Full enforcement
v=DMARC1; p=reject; sp=reject; rua=mailto:[email protected]; adkim=s; aspf=s

Required Tags

v= Default: -
Version (v)
e.g. v=DMARC1
p= Default: -
Policy (p)
e.g. p=reject

Optional Tags

ruf= Default: No forensic reports sent
Forensic Report URI (ruf)
e.g. ruf=mailto:[email protected]
adkim= Default: r (relaxed)
DKIM Alignment (adkim)
e.g. adkim=r
aspf= Default: r (relaxed)
SPF Alignment (aspf)
e.g. aspf=r
fo= Default: 0
Failure Options (fo)
e.g. fo=1
rf= Default: afrf
Report Format (rf)
e.g. rf=afrf
ri= Default: 86400 (24 hours)
Report Interval (ri)
e.g. ri=86400
pct= Default: 100
Percentage (pct)
e.g. pct=100
t= Default: n
Testing Mode (t)
e.g. t=y
np= Default: Inherits from sp= or p=
Non-existent Subdomain Policy (np)
e.g. np=reject
psd= Default: u (unknown)
Public Suffix Domain (psd)
e.g. psd=n

Quick Reference: All DMARC Tags

Fourteen tags, of which two are required and three should not go in a new record. The second column says what has to be true of your setup before a tag earns its place.

Tag When you need it Required? Valid Values Default
v Always. Every DMARC record starts with it, and a record that does not is ignored outright. Yes DMARC1 -
p Always. Begin at p=none, and move to quarantine and then reject once the aggregate reports are clean. Yes none, quarantine, reject -
sp Your subdomains need a different policy from the parent: usually stricter, occasionally looser while one of them is still being fixed. No none, quarantine, reject Inherits from p
rua Almost always. Without an address here you never learn who is sending as your domain, so you can never safely tighten the policy. No mailto: URI(s), comma-separated No aggregate reports sent
ruf Rarely. Google, Microsoft and Yahoo stopped sending failure reports, so an address here mostly collects nothing. No mailto: URI(s), comma-separated No forensic reports sent
adkim Your DKIM signature always uses the exact From domain and you want signatures from anywhere else in the organisation to stop aligning. Leave it off otherwise. No r, s r (relaxed)
aspf The same idea for SPF. Strict breaks any sender whose bounce address is not exactly your From domain, which is why RFC 9989 §4.4 notes that nearly all domain owners stay on relaxed. No r, s r (relaxed)
fo You have set ruf and want a report when only one of SPF or DKIM fails, rather than only when both do. No 0, 1, d, s 0
rf Never in a new record. RFC 9989 removed the tag, and only one format was ever defined for it. No afrf afrf
ri Never in a new record. RFC 9989 moved it out of the core spec, and receivers sent daily reports whatever it said. No Positive integer (seconds) 86400 (24 hours)
pct Never in a new record. RFC 9989 removed it because receivers implemented the sampling inconsistently. Use t=y instead. No 0-100 (integer) 100
t You are moving to quarantine or reject and want receivers to go gently while you watch what the reports say. No y, n n
np Someone is spoofing subdomains you never created. This rejects those outright without touching the policy on your real ones. No none, quarantine, reject Inherits from sp= or p=
psd You run a registry or a shared domain space where each subdomain belongs to a different organisation. Almost nobody else needs it. No y, n, u u (unknown)

🛡️ Analyse or Build Your DMARC Record

Check your current DMARC record for issues, or build a new one from scratch.

DMARC Analyser → DMARC Builder → DMARC Report Viewer →