--- title: "DMARC Record: Tags & How to Publish One | AutoSPF" description: "A DMARC record is a DNS TXT record published at _dmarc.yourdomain.com that sets your DMARC policy (p=), SPF/DKIM alignment modes (aspf/adkim), and where ag" image: "https://autospf.com/images/og-default.png" canonical: "https://autospf.com/dmarc/dmarc-record/" --- # DMARC Record A DMARC record is a DNS TXT record published at \_dmarc.yourdomain.com that sets your DMARC policy (p=), SPF/DKIM alignment modes (aspf/adkim), and where aggregate (rua) and forensic (ruf) reports are sent. This guide is part of our complete guide to [DMARC](/dmarc/). Related: [the DMARC policy](/dmarc/dmarc-policy/) and [how to set up DMARC](/dmarc/how-to-setup-dmarc/). **A DMARC record is a DNS TXT record published at `_dmarc.yourdomain.com` that tells receiving mail servers how to handle messages that fail authentication. It sets your DMARC policy, defines SPF and DKIM alignment modes, and specifies the addresses where aggregate and forensic reports are sent.** A DMARC record ties your existing SPF and DKIM setup together and gives you visibility into who is sending email as your domain. Receivers read it during message evaluation, decide what to do with failing mail, and send reports back to the addresses you name. ## What a DMARC record looks like A DMARC record is a single TXT record whose value is a semicolon-separated list of tags. Here is a strict, enforcing example: ``` _dmarc.example.com TXT "v=DMARC1; p=reject; rua=mailto:dmarc@example.com; adkim=s; aspf=s; pct=100" ``` The host is `_dmarc.example.com`, the type is `TXT`, and the quoted string is the policy itself. Every DMARC record begins with `v=DMARC1` and states a policy with `p=`. Everything else is optional and fills in reporting and alignment behavior. ## The tags in a DMARC record Each tag controls one aspect of how receivers evaluate and report on your mail. Only `v` and `p` are required; the rest fall back to sensible defaults when omitted. | Tag | Purpose | Notes | | ----- | ------------------------------------- | --------------------------------------------------- | | v | Protocol version | **Required.** Must be v=DMARC1 and appear first | | p | Policy for the domain | **Required.** none, quarantine, or reject | | sp | Policy for subdomains | Inherits p if omitted | | rua | Aggregate report address | mailto: URI; where daily XML reports are sent | | ruf | Forensic report address | mailto: URI; per-failure samples (rarely supported) | | adkim | DKIM alignment mode | r relaxed (default) or s strict | | aspf | SPF alignment mode | r relaxed (default) or s strict | | pct | Percent of mail the policy applies to | 1–100, defaults to 100 | | fo | Forensic reporting options | 0, 1, d, or s for when samples are generated | Tags can appear in any order after `v`, and unknown tags are ignored by compliant receivers. ## Where a DMARC record lives A DMARC record is always published as a TXT record at the `_dmarc` subdomain of the domain it protects — for `example.com` that is `_dmarc.example.com`. You add it in your DNS provider’s control panel the same way you add any TXT record: host `_dmarc`, type `TXT`, and the policy string as the value. Each domain and subdomain can have its own DMARC record. If a subdomain has no record of its own, receivers fall back to the organizational domain’s record and apply its `sp` tag (or `p` when `sp` is absent). A domain should have only one DMARC TXT record; multiple records make the policy invalid. ## Alignment: aspf and adkim Alignment is what connects a passing SPF or DKIM check to the domain your recipients actually see in the `From` header. The `aspf` and `adkim` tags control how exact that match must be. - **Relaxed (`r`)** — the default. The authenticated domain and the `From` domain only need to share the same organizational domain. `mail.example.com` aligns with `example.com`. - **Strict (`s`)** — the domains must match exactly. `mail.example.com` does not align with `example.com`. Alignment is the reason DMARC is stronger than SPF or DKIM alone: a message can pass SPF and still fail DMARC if the passing domain does not align with the visible sender. For `aspf` to help you, you first need a valid, passing [SPF record](/tools/spf-checker/) that authorizes your senders. For how alignment feeds into enforcement decisions, see [the DMARC policy](/dmarc/dmarc-policy/). ## How to publish and check it Publishing a DMARC record is a single DNS change, but rolling it out safely means starting at `p=none` for monitoring, reading your `rua` reports, and tightening toward `p=reject` only once legitimate mail is aligned. The full rollout sequence is covered in [how to set up DMARC](/dmarc/how-to-setup-dmarc/). Once the record is live, confirm it resolves and parses correctly with our free [DMARC checker](/tools/dmarc-checker/). It fetches the TXT record at `_dmarc.yourdomain.com`, validates every tag, and flags common mistakes like a missing `v=DMARC1`, an invalid policy value, or a malformed reporting address before they cost you deliverability. ## Frequently Asked Questions ### What is a DMARC record? A DMARC record is a DNS TXT record published at `_dmarc.yourdomain.com` that tells receiving servers how to treat email failing SPF and DKIM authentication. It defines your enforcement policy, sets SPF and DKIM alignment modes, and lists the addresses where receivers send aggregate and forensic reports about your domain’s mail. ### Where is a DMARC record published? A DMARC record is published as a TXT record at the `_dmarc` subdomain of the domain it protects, so for `example.com` the host is `_dmarc.example.com`. You create it in your DNS provider’s control panel exactly like any other TXT record. Each domain should have only one DMARC record, or the policy becomes invalid. ### What does the rua tag do? The `rua` tag names the address that receives DMARC aggregate reports, written as a `mailto:` URI such as `rua=mailto:dmarc@example.com`. Receiving servers send these daily XML reports summarizing which sources sent mail as your domain and whether it passed SPF, DKIM, and alignment. Reading them is how you find legitimate senders before enforcing a strict policy. ### What is the difference between aspf=s and aspf=r? `aspf=r` is relaxed SPF alignment, the default, where the SPF-authenticated domain only needs to share the same organizational domain as the `From` address. `aspf=s` is strict alignment, requiring the two domains to match exactly. Strict is more secure but can break mail from subdomains or third-party senders, so most domains start with relaxed alignment. Rated 5/5 on G2 · Trusted since 2018 ## Trusted by 50,000+ domains ### "AutoSPF Flattens SPF Records Seamlessly & Keeps Changes Logged - I am quite pleased with the product" > It does what it promises to do, and does it very well. I appreciate that it keeps a log of changes made, which prevents many mistakes. A client's SPF record would have way too many lookups, but AutoSPF makes that problem go away. The length of the SPF record is typically not the issue; it's the amount of lookups in the record that are. AutoSPF "flattens" the record, automatically expanding the defined lookups to IP addresses or ranges. And it auto-updates the record when the un-flattened lookups change. PJ Peter J. President · Small-Business (50 or fewer emp.) ### "Helped us go beyond capacity" > AutoSPF did exactly as described, it helped us get past our 10 lookup limit. Afterwards, we hit another limit regarding overall capacity and when contacted, they quickly provided us with a new solution to eliminate capacity issues entirely going forward, so now we can add as many SPF records as needed. They also provided us with a personalized support video explaining their new method in its entirety using our instance as the example. VU Verified User Financial Services · Mid-Market (51-1000 emp.) ### "Great service and great support" > AutoSPF was easy to initially set up on our own and a great cost effective entry into spf flattening. Needed our first support assistance today and got great response including a video demonstrating the issue I was trying to solve, a quick fix, and more detailed followup. GF Greg F. Mid-Market (51-1000 emp.) [Read our reviews on G2 ](https://www.g2.com/products/autospf/reviews) ```json {"@context":"https://schema.org","@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com","logo":{"@type":"ImageObject","url":"https://autospf.com/images/autospf-logo.png"},"description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138897474","https://www.linkedin.com/company/autospf","https://x.com/autospf01","https://www.facebook.com/autospf","https://github.com/duocircle","https://www.g2.com/products/autospf/reviews"],"aggregateRating":{"@type":"AggregateRating","ratingValue":"5.0","reviewCount":"21","bestRating":"5","worstRating":"1","url":"https://www.g2.com/products/autospf/reviews"},"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://autospf.com/contact-us/"},"knowsAbout":["SPF Record Flattening","Sender Policy Framework","Email Authentication","DNS Management","DMARC","DKIM","Email Deliverability","SPF Lookup Limits"]} ``` ```json {"@context":"https://schema.org","@type":"WebSite","name":"AutoSPF","url":"https://autospf.com","description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","publisher":{"@type":"Organization","name":"AutoSPF","url":"https://autospf.com","logo":{"@type":"ImageObject","url":"https://autospf.com/images/autospf-logo.png"},"description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}}} ``` ```json {"@context":"https://schema.org","@type":"FAQPage","mainEntity":[{"@type":"Question","name":"What is a DMARC record?","acceptedAnswer":{"@type":"Answer","text":"A DMARC record is a DNS TXT record published at `_dmarc.yourdomain.com` that tells receiving servers how to treat email failing SPF and DKIM authentication. It defines your enforcement policy, sets SPF and DKIM alignment modes, and lists the addresses where receivers send aggregate and forensic reports about your domain's mail."}},{"@type":"Question","name":"Where is a DMARC record published?","acceptedAnswer":{"@type":"Answer","text":"A DMARC record is published as a TXT record at the `_dmarc` subdomain of the domain it protects, so for `example.com` the host is `_dmarc.example.com`. You create it in your DNS provider's control panel exactly like any other TXT record. Each domain should have only one DMARC record, or the policy becomes invalid."}},{"@type":"Question","name":"What does the rua tag do?","acceptedAnswer":{"@type":"Answer","text":"The `rua` tag names the address that receives DMARC aggregate reports, written as a `mailto:` URI such as `rua=mailto:dmarc@example.com`. Receiving servers send these daily XML reports summarizing which sources sent mail as your domain and whether it passed SPF, DKIM, and alignment. Reading them is how you find legitimate senders before enforcing a strict policy."}},{"@type":"Question","name":"What is the difference between aspf=s and aspf=r?","acceptedAnswer":{"@type":"Answer","text":"`aspf=r` is relaxed SPF alignment, the default, where the SPF-authenticated domain only needs to share the same organizational domain as the `From` address. `aspf=s` is strict alignment, requiring the two domains to match exactly. Strict is more secure but can break mail from subdomains or third-party senders, so most domains start with relaxed alignment."}}]} ``` ```json {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://autospf.com/"},{"@type":"ListItem","position":2,"name":"DMARC","item":"https://autospf.com/dmarc/"},{"@type":"ListItem","position":3,"name":"DMARC Record","item":"https://autospf.com/dmarc/dmarc-record/"}]} ``` ```json {"@context":"https://schema.org","@type":"Product","name":"AutoSPF","url":"https://autospf.com","aggregateRating":{"@type":"AggregateRating","ratingValue":5,"reviewCount":21,"bestRating":5,"worstRating":1},"review":[{"@type":"Review","reviewRating":{"@type":"Rating","ratingValue":5,"bestRating":5},"author":{"@type":"Person","name":"Peter J.","jobTitle":"President"},"datePublished":"2026-03-10","reviewBody":"It does what it promises to do, and does it very well. I appreciate that it keeps a log of changes made, which prevents many mistakes. A client's SPF record would have way too many lookups, but AutoSPF makes that problem go away. The length of the SPF record is typically not the issue; it's the amount of lookups in the record that are. AutoSPF \"flattens\" the record, automatically expanding the defined lookups to IP addresses or ranges. And it auto-updates the record when the un-flattened lookups change.","name":"AutoSPF Flattens SPF Records Seamlessly & Keeps Changes Logged - I am quite pleased with the product","publisher":{"@type":"Organization","name":"G2","url":"https://www.g2.com"}},{"@type":"Review","reviewRating":{"@type":"Rating","ratingValue":5,"bestRating":5},"author":{"@type":"Person","name":"Verified User","jobTitle":"Financial Services"},"datePublished":"2025-07-31","reviewBody":"AutoSPF did exactly as described, it helped us get past our 10 lookup limit. Afterwards, we hit another limit regarding overall capacity and when contacted, they quickly provided us with a new solution to eliminate capacity issues entirely going forward, so now we can add as many SPF records as needed. They also provided us with a personalized support video explaining their new method in its entirety using our instance as the example.","name":"Helped us go beyond capacity","publisher":{"@type":"Organization","name":"G2","url":"https://www.g2.com"}},{"@type":"Review","reviewRating":{"@type":"Rating","ratingValue":5,"bestRating":5},"author":{"@type":"Person","name":"Greg F."},"datePublished":"2023-07-26","reviewBody":"AutoSPF was easy to initially set up on our own and a great cost effective entry into spf flattening. Needed our first support assistance today and got great response including a video demonstrating the issue I was trying to solve, a quick fix, and more detailed followup.","name":"Great service and great support","publisher":{"@type":"Organization","name":"G2","url":"https://www.g2.com"}}]} ```