DMARC Record
A DMARC record is a DNS TXT record published at _dmarc.yourdomain.com that sets your DMARC policy (p=), SPF/DKIM alignment modes (aspf/adkim), and where aggregate (rua) and forensic (ruf) reports are sent.
This guide is part of our complete guide to DMARC. Related: the DMARC policy and how to set up DMARC.
A DMARC record is a DNS TXT record published at _dmarc.yourdomain.com that tells receiving mail servers how to handle messages that fail authentication. It sets your DMARC policy, defines SPF and DKIM alignment modes, and specifies the addresses where aggregate and forensic reports are sent.
A DMARC record ties your existing SPF and DKIM setup together and gives you visibility into who is sending email as your domain. Receivers read it during message evaluation, decide what to do with failing mail, and send reports back to the addresses you name.
What a DMARC record looks like
A DMARC record is a single TXT record whose value is a semicolon-separated list of tags. Here is a strict, enforcing example:
_dmarc.example.com TXT "v=DMARC1; p=reject; rua=mailto:dmarc@example.com; adkim=s; aspf=s; pct=100"The host is _dmarc.example.com, the type is TXT, and the quoted string is the policy itself. Every DMARC record begins with v=DMARC1 and states a policy with p=. Everything else is optional and fills in reporting and alignment behavior.
The tags in a DMARC record
Each tag controls one aspect of how receivers evaluate and report on your mail. Only v and p are required; the rest fall back to sensible defaults when omitted.
| Tag | Purpose | Notes |
|---|---|---|
v | Protocol version | Required. Must be v=DMARC1 and appear first |
p | Policy for the domain | Required. none, quarantine, or reject |
sp | Policy for subdomains | Inherits p if omitted |
rua | Aggregate report address | mailto: URI; where daily XML reports are sent |
ruf | Forensic report address | mailto: URI; per-failure samples (rarely supported) |
adkim | DKIM alignment mode | r relaxed (default) or s strict |
aspf | SPF alignment mode | r relaxed (default) or s strict |
pct | Percent of mail the policy applies to | 1–100, defaults to 100 |
fo | Forensic reporting options | 0, 1, d, or s for when samples are generated |
Tags can appear in any order after v, and unknown tags are ignored by compliant receivers.
Where a DMARC record lives
A DMARC record is always published as a TXT record at the _dmarc subdomain of the domain it protects — for example.com that is _dmarc.example.com. You add it in your DNS provider’s control panel the same way you add any TXT record: host _dmarc, type TXT, and the policy string as the value.
Each domain and subdomain can have its own DMARC record. If a subdomain has no record of its own, receivers fall back to the organizational domain’s record and apply its sp tag (or p when sp is absent). A domain should have only one DMARC TXT record; multiple records make the policy invalid.
Alignment: aspf and adkim
Alignment is what connects a passing SPF or DKIM check to the domain your recipients actually see in the From header. The aspf and adkim tags control how exact that match must be.
- Relaxed (
r) — the default. The authenticated domain and theFromdomain only need to share the same organizational domain.mail.example.comaligns withexample.com. - Strict (
s) — the domains must match exactly.mail.example.comdoes not align withexample.com.
Alignment is the reason DMARC is stronger than SPF or DKIM alone: a message can pass SPF and still fail DMARC if the passing domain does not align with the visible sender. For aspf to help you, you first need a valid, passing SPF record that authorizes your senders. For how alignment feeds into enforcement decisions, see the DMARC policy.
How to publish and check it
Publishing a DMARC record is a single DNS change, but rolling it out safely means starting at p=none for monitoring, reading your rua reports, and tightening toward p=reject only once legitimate mail is aligned. The full rollout sequence is covered in how to set up DMARC.
Once the record is live, confirm it resolves and parses correctly with our free DMARC checker. It fetches the TXT record at _dmarc.yourdomain.com, validates every tag, and flags common mistakes like a missing v=DMARC1, an invalid policy value, or a malformed reporting address before they cost you deliverability.
Frequently Asked Questions
What is a DMARC record?
A DMARC record is a DNS TXT record published at _dmarc.yourdomain.com that tells receiving servers how to treat email failing SPF and DKIM authentication. It defines your enforcement policy, sets SPF and DKIM alignment modes, and lists the addresses where receivers send aggregate and forensic reports about your domain’s mail.
Where is a DMARC record published?
A DMARC record is published as a TXT record at the _dmarc subdomain of the domain it protects, so for example.com the host is _dmarc.example.com. You create it in your DNS provider’s control panel exactly like any other TXT record. Each domain should have only one DMARC record, or the policy becomes invalid.
What does the rua tag do?
The rua tag names the address that receives DMARC aggregate reports, written as a mailto: URI such as rua=mailto:dmarc@example.com. Receiving servers send these daily XML reports summarizing which sources sent mail as your domain and whether it passed SPF, DKIM, and alignment. Reading them is how you find legitimate senders before enforcing a strict policy.
What is the difference between aspf=s and aspf=r?
aspf=r is relaxed SPF alignment, the default, where the SPF-authenticated domain only needs to share the same organizational domain as the From address. aspf=s is strict alignment, requiring the two domains to match exactly. Strict is more secure but can break mail from subdomains or third-party senders, so most domains start with relaxed alignment.