What the parts of a DMARC record mean
DMARC (Domain-based Message Authentication, Reporting and Conformance) works alongside SPF and DKIM to protect your domain from spoofing. A DMARC record is a short line of text that tells receiving email servers (Gmail, Outlook, Yahoo, etc.) how to handle messages that claim to come from your domain but fail authentication checks. It’s made up of several tags, each separated by a semicolon.
v= (version) Identifies which version of DMARC the record is using. It’s always v=DMARC1 — this is required and never changes. Think of it as the label that tells mail servers “this is a DMARC record, read it accordingly.”
p= (policy) The main policy — it tells mail servers what to do with messages from your domain that fail authentication (meaning they failed both SPF and DKIM checks). There are three options:
p=none— Monitor only. Don’t block or filter anything; just let the reports roll in. This is the usual starting point so you can see what’s happening before enforcing anything.p=quarantine— Send failing messages to the spam/junk folder.p=reject— Refuse failing messages outright so they never reach the recipient at all. This is the strongest setting and is typically the end goal after a clean monitoring period.
pct= (percentage) The percentage of failing messages the policy above is applied to. pct=100 (the default if omitted) means the policy applies to all failing mail. pct=50 means only half of failing messages get quarantined or rejected, and the other half are delivered normally. This is a dial used during rollout to gradually ramp up enforcement without breaking legitimate email.
sp= (subdomain policy) The policy for subdomains of your domain (for example, news.yoursite.org or events.yoursite.org). If omitted, subdomains inherit the main p= policy. sp=none specifically says “don’t enforce anything on subdomains” — which can be a gap if a spammer spoofs a subdomain you don’t actively use.
Other tags worth knowing
rua= (aggregate reporting address) An email address where mailbox providers send daily aggregate reports summarizing which messages passed or failed DMARC. These reports are how you find out whether your legitimate email is authenticating correctly — without this, you’re flying blind. Example: rua=mailto:dmarc@yoursite.org. Many organizations point this at a dedicated DMARC monitoring service (dmarcian, EasyDMARC, Postmark, Valimail, etc.) that turns the raw reports into a readable dashboard.
ruf= (forensic reporting address) An email address for detailed per-message failure reports. Less commonly used these days because of privacy concerns, and most providers no longer send these.
adkim= and aspf= (alignment mode) Control how strictly DKIM and SPF are matched against the “From” address. Defaults to relaxed (r), which is what most organizations use. Strict mode (s) requires an exact match. You typically don’t need to touch these.
How to read an example record
v=DMARC1; p=quarantine; pct=50; sp=noneIn plain terms: “This is a DMARC record. Send failing mail from yoursite.org to spam, but only do that for half of it. Don’t enforce anything on subdomains. And don’t send reports to anyone.”
Adding a rua= tag sends daily aggregate DMARC reports — summarizing which messages passed or failed — to the address you specify:
v=DMARC1; p=quarantine; pct=50; sp=none; rua=mailto:dmarc@yoursite.org