TXT
TXT Record: DMARC
DMARC is published as a TXT record at _dmarc.example.com. Learn every tag, the rollout path from none to reject, and how to set up aggregate reports.
Published · Last verified · Maintained by TamingDNS
TXT
Authentication (TXT)
RFC 9989
Yes
TXT "v=DMARC1; p=<policy>; rua=mailto:<address>"
3600 s; lower during initial rollout (p=none phase)
💬 What This Record Does
DMARC (Domain-based Message Authentication, Reporting, and Conformance) ties together SPF and DKIM. It is published as a TXT record at _dmarc.example.com and tells receiving servers what to do with messages that fail SPF or DKIM alignment: nothing (p=none), quarantine them (p=quarantine), or reject them outright (p=reject). DMARC also enables aggregate (rua) and forensic (ruf) reports so you can see who is sending from your domain.
Common Uses
- Protecting your domain from impersonation and phishing
- Receiving aggregate reports (RUA) to audit your email streams
- Progressing from p=none (monitoring) to p=quarantine to p=reject as confidence grows
⚠️ Watch Out For
- DMARC checks alignment. The SPF or DKIM domain must match the From: header domain.
- Jump straight to p=reject without monitoring and you may accidentally block legitimate email.
- The rua address on an external domain (e.g., reports go to a different domain) requires a DNS verification record on that domain.
🔧 Related Tools
📋 Complete Example Records
Whole records in zone-file form: name, TTL, class, type, then the data. Most DNS panels ask for the pieces separately. Look them up live with the DNS Lookup tool.
_dmarc.example.com. 3600 IN TXT "v=DMARC1; p=none; rua=mailto:dmarc-feedback@example.com"
The starting record, and note the name. DMARC lives at _dmarc, never on the domain itself, which is the most common reason a checker reports nothing.
_dmarc.example.com. 3600 IN TXT "v=DMARC1; p=reject; rua=mailto:dmarc-feedback@example.com"
This is the finished version of the same record. Only the policy value changed to get here.
_dmarc.example.com. 3600 IN TXT "v=DMARC1; p=reject; sp=none; np=reject; adkim=s; aspf=s; rua=mailto:dmarc-feedback@example.com"
A fuller record using the RFC 9989 tags. Existing subdomains are left alone, invented ones are refused, and both identifiers must align exactly.
_dmarc.subdomain.example.com. 3600 IN TXT "v=DMARC1; p=reject; rua=mailto:dmarc-feedback@example.com"
Here a subdomain publishes its own policy, which is what you want when one subdomain needs different treatment from the parent record.