DMARC fo= Tag: Failure Options (fo)

The DMARC fo tag controls when forensic (ruf) reports are generated. Options: 0=any failure, 1=all mechanisms fail, d=DKIM failure, s=SPF failure.

Published · Last verified · Maintained by TamingDNS

Importance
Optional
Tag
fo=
Default
0
Example
fo=1

✅ Valid Values

0 Default. Report generated only when both SPF and DKIM produce non-passing results.
1 Report generated when either SPF or DKIM produces a non-passing result.
d Report generated when DKIM evaluation fails.
s Report generated when SPF evaluation fails.

💬 What This Tag Does

The "fo" tag only matters if you've set up "ruf" forensic reports. It controls when individual failure reports are generated. Value "0" (default) sends a report only if both SPF and DKIM fail. Value "1" sends a report if either SPF or DKIM fails. "d" sends on DKIM failure only; "s" sends on SPF failure only. Multiple values can be colon-separated.

📋 Complete Example Records

Every one of these is a complete record you can paste as it stands. Each goes in a TXT record at _dmarc.yourdomain.com. Check yours with the DMARC Checker or assemble one in the DMARC Builder.

v=DMARC1; p=reject; ruf=mailto:auth-reports@example.com; fo=1

Report whenever either mechanism fails to produce an aligned pass. That is more reports than the default, and it is usually the reason you set "ruf" in the first place.

v=DMARC1; p=reject; ruf=mailto:auth-reports@example.com; fo=0:d

Two values, colon-separated, as RFC 9989 §4.7 shows. The order does not matter, and "0" and "1" are the one pair you cannot combine.

v=DMARC1; p=reject; ruf=mailto:auth-reports@example.com; fo=d:s

DKIM and SPF failures reported in their own formats regardless of alignment, which is the pair to use when you are chasing a signing problem.

v=DMARC1; p=reject; fo=1; rua=mailto:dmarc-feedback@example.com

The tag does nothing in this record. With no "ruf" tag present, the content of "fo" MUST be ignored.

🔗 Related DMARC Tags

ruf=
Forensic Report URI (ruf)

🛡️ Related Tools

Analyse your current DMARC record, build a new one, or read the aggregate reports that tell you whether the policy is safe to tighten.

DMARC Analyser → DMARC Builder → DMARC Report Viewer → SPF Checker →
← All DMARC tags