TXT TXT Record: DMARC

DMARC is published as a TXT record at _dmarc.example.com. Learn every tag, the rollout path from none to reject, and how to set up aggregate reports.

Published · Last verified · Maintained by TamingDNS

Record Type
TXT
Category
Authentication (TXT)
RFC
RFC 9989
Email Relevant
Yes
Format
TXT "v=DMARC1; p=<policy>; rua=mailto:<address>"
Example
TXT "v=DMARC1; p=reject; rua=mailto:[email protected]; adkim=s; aspf=s"
TTL Guidance
3600 s; lower during initial rollout (p=none phase)

💬 What This Record Does

DMARC (Domain-based Message Authentication, Reporting, and Conformance) ties together SPF and DKIM. It is published as a TXT record at _dmarc.example.com and tells receiving servers what to do with messages that fail SPF or DKIM alignment: nothing (p=none), quarantine them (p=quarantine), or reject them outright (p=reject). DMARC also enables aggregate (rua) and forensic (ruf) reports so you can see who is sending from your domain.

Common Uses

  • Protecting your domain from impersonation and phishing
  • Receiving aggregate reports (RUA) to audit your email streams
  • Progressing from p=none (monitoring) to p=quarantine to p=reject as confidence grows

⚠️ Watch Out For

  • DMARC checks alignment. The SPF or DKIM domain must match the From: header domain.
  • Jump straight to p=reject without monitoring and you may accidentally block legitimate email.
  • The rua address on an external domain (e.g., reports go to a different domain) requires a DNS verification record on that domain.

📋 Complete Example Records

Whole records in zone-file form: name, TTL, class, type, then the data. Most DNS panels ask for the pieces separately. Look them up live with the DNS Lookup tool.

_dmarc.example.com.  3600  IN  TXT  "v=DMARC1; p=none; rua=mailto:dmarc-feedback@example.com"

The starting record, and note the name. DMARC lives at _dmarc, never on the domain itself, which is the most common reason a checker reports nothing.

_dmarc.example.com.  3600  IN  TXT  "v=DMARC1; p=reject; rua=mailto:dmarc-feedback@example.com"

This is the finished version of the same record. Only the policy value changed to get here.

_dmarc.example.com.  3600  IN  TXT  "v=DMARC1; p=reject; sp=none; np=reject; adkim=s; aspf=s; rua=mailto:dmarc-feedback@example.com"

A fuller record using the RFC 9989 tags. Existing subdomains are left alone, invented ones are refused, and both identifiers must align exactly.

_dmarc.subdomain.example.com.  3600  IN  TXT  "v=DMARC1; p=reject; rua=mailto:dmarc-feedback@example.com"

Here a subdomain publishes its own policy, which is what you want when one subdomain needs different treatment from the parent record.