What Is a DMARC Record? Email Policy Explained

· Unified DNS Team · 10 min read

What Is a DMARC Record?

A DMARC record (Domain-based Message Authentication, Reporting & Conformance) is a DNS TXT record that tells receiving mail servers what to do when email fails SPF or DKIM checks. It's the policy layer that ties SPF and DKIM together into a complete email authentication system.

The Basics

Why DMARC Matters

Without DMARC, SPF and DKIM operate independently with no coordinated policy:

DMARC provides:

Example DMARC Record

_dmarc.example.com.    3600    IN    TXT    "v=DMARC1; p=reject; rua=mailto:dmarc@example.com; ruf=mailto:dmarc-forensic@example.com"

How DMARC Works

The Authentication Flow

  1. Email received — Mail server receives email claiming to be from user@example.com
  2. SPF check — Is the sending IP authorized?
  3. DKIM check — Is the signature valid?
  4. DMARC alignment check — Do SPF/DKIM domains align with the "From" header?
  5. Policy lookup — What does _dmarc.example.com say to do?
  6. Policy applied — None, quarantine, or reject based on DMARC record
  7. Report generated — Results sent to addresses in rua/ruf tags

DMARC Alignment

DMARC requires alignment — the domain in SPF or DKIM must match the "From" header domain:

SPF Alignment:

DKIM Alignment:

DMARC Pass Requires:

Example: Email From: user@example.com

CheckDetailsResult
**SPF**Envelope From: mail.example.com
Sending IP authorized?Yes
Aligned with example.com?Yes (relaxed)
**SPF Result**PASS + ALIGNED
**DKIM**d=example.com
Signature valid?Yes
Aligned with example.com?Yes
**DKIM Result**PASS + ALIGNED
**DMARC****PASS** (both SPF and DKIM aligned)

DMARC Record Structure

Record Location

DMARC records are always at _dmarc.domain.com:

_dmarc.example.com.    3600    IN    TXT    "v=DMARC1; p=reject; rua=mailto:dmarc@example.com"

DMARC Tags

TagRequiredDescription
**v**YesVersion (always DMARC1)
**p**YesPolicy for domain (none, quarantine, reject)
**sp**NoPolicy for subdomains
**rua**NoAggregate report destination
**ruf**NoForensic report destination
**adkim**NoDKIM alignment mode (r=relaxed, s=strict)
**aspf**NoSPF alignment mode (r=relaxed, s=strict)
**pct**NoPercentage of messages to apply policy
**fo**NoForensic report options
**ri**NoReport interval in seconds

Complete Example

_dmarc.example.com.    TXT    "v=DMARC1; p=reject; sp=reject; adkim=r; aspf=r; pct=100; rua=mailto:dmarc-aggregate@example.com; ruf=mailto:dmarc-forensic@example.com; fo=1; ri=86400"

DMARC Policies Explained

p=none (Monitor Only)

_dmarc.example.com.    TXT    "v=DMARC1; p=none; rua=mailto:dmarc@example.com"

p=quarantine

_dmarc.example.com.    TXT    "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com"

p=reject

_dmarc.example.com.    TXT    "v=DMARC1; p=reject; rua=mailto:dmarc@example.com"

Gradual Enforcement with pct=

Roll out enforcement gradually:

; Start: Monitor only
_dmarc.example.com.    TXT    "v=DMARC1; p=none; rua=mailto:dmarc@example.com"

; Step 2: Quarantine 25% of failures
_dmarc.example.com.    TXT    "v=DMARC1; p=quarantine; pct=25; rua=mailto:dmarc@example.com"

; Step 3: Quarantine 50%
_dmarc.example.com.    TXT    "v=DMARC1; p=quarantine; pct=50; rua=mailto:dmarc@example.com"

; Step 4: Quarantine 100%
_dmarc.example.com.    TXT    "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com"

; Step 5: Reject 25%
_dmarc.example.com.    TXT    "v=DMARC1; p=reject; pct=25; rua=mailto:dmarc@example.com"

; Final: Reject 100%
_dmarc.example.com.    TXT    "v=DMARC1; p=reject; rua=mailto:dmarc@example.com"

Subdomain Policy (sp=)

Control subdomains separately:

; Reject for main domain, quarantine for subdomains
_dmarc.example.com.    TXT    "v=DMARC1; p=reject; sp=quarantine; rua=mailto:dmarc@example.com"

; Reject for all, including subdomains
_dmarc.example.com.    TXT    "v=DMARC1; p=reject; sp=reject; rua=mailto:dmarc@example.com"

Understanding DMARC Reports

Aggregate Reports (rua)

Daily XML reports showing:

_dmarc.example.com.    TXT    "v=DMARC1; p=reject; rua=mailto:dmarc-reports@example.com"

Example aggregate report data:

Forensic Reports (ruf)

Individual failure reports with email details:

_dmarc.example.com.    TXT    "v=DMARC1; p=reject; rua=mailto:dmarc@example.com; ruf=mailto:dmarc-forensic@example.com; fo=1"

fo= options:

Note: Many providers don't send forensic reports due to privacy concerns.

Using DMARC Report Analyzers

Raw DMARC reports are XML and hard to read. Use analysis tools:

DMARC Implementation Guide

Phase 1: Assessment

  1. Inventory all email sources:
  1. Verify SPF is configured:
    2.    dig TXT example.com | grep spf
  1. Verify DKIM is configured:
    2.    dig TXT selector1._domainkey.example.com

Phase 2: Monitor

Deploy DMARC in monitor mode:

_dmarc.example.com.    TXT    "v=DMARC1; p=none; rua=mailto:dmarc@example.com"

Phase 3: Quarantine

Start enforcement gradually:

; Start with 25% quarantine
_dmarc.example.com.    TXT    "v=DMARC1; p=quarantine; pct=25; rua=mailto:dmarc@example.com"

; Increase to 50% quarantine
_dmarc.example.com.    TXT    "v=DMARC1; p=quarantine; pct=50; rua=mailto:dmarc@example.com"

; Full quarantine
_dmarc.example.com.    TXT    "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com"

Monitor for legitimate email going to spam.

Phase 4: Reject

Full enforcement:

; Gradual reject
_dmarc.example.com.    TXT    "v=DMARC1; p=reject; pct=25; rua=mailto:dmarc@example.com"

; Full reject
_dmarc.example.com.    TXT    "v=DMARC1; p=reject; rua=mailto:dmarc@example.com"

Best Practices for MSPs

1. Always Start with p=none

Never deploy DMARC with enforcement immediately:

2. Use a DMARC Report Analyzer

Raw reports are unusable. Use tools like:

3. Fix SPF and DKIM First

DMARC is only as good as your SPF and DKIM:

4. Account for Email Forwarding

Email forwarding breaks SPF (and sometimes DKIM):

5. Don't Forget Subdomains

Attackers often spoof subdomains. Use sp= tag:

_dmarc.example.com.    TXT    "v=DMARC1; p=reject; sp=reject; rua=mailto:dmarc@example.com"

6. Monitor Continuously

DMARC isn't "set and forget":

7. Use Unified DNS for DMARC Monitoring

Managing DMARC across dozens of client domains requires visibility. Unified DNS provides:

Troubleshooting DMARC

Legitimate Email Failing DMARC

Check alignment:

Common causes:

Not Receiving DMARC Reports

Verify rua address:

dig TXT _dmarc.example.com

Check:

Testing DMARC

Query DMARC record:

dig TXT _dmarc.example.com +short

Send test email:

  1. Send to Gmail
  2. View original message
  3. Look for "DMARC: PASS"

Online tools:

Frequently Asked Questions

Do I need SPF and DKIM before DMARC?

You need at least one (SPF or DKIM) configured and passing for DMARC to work. Best practice is to have both.

What policy should I use?

Most organizations should aim for p=reject.

How long should I stay at p=none?

2-4 weeks minimum, longer for complex organizations. You need enough report data to identify all legitimate senders.

Will DMARC break my email?

If implemented correctly with monitoring first, no. If you deploy p=reject immediately without checking reports, yes.

Do I need DMARC for subdomains?

Yes! Attackers often target subdomains. Use sp=reject to protect them.

What's the difference between DMARC and BIMI?

DMARC is authentication policy. BIMI (Brand Indicators for Message Identification) displays your logo in email clients but requires DMARC at p=quarantine or p=reject first.

Is DMARC required for compliance?

Increasingly yes:

Get Started with Unified DNS

DMARC is essential for email security and increasingly required for compliance. Unified DNS lets you view, modify, audit, and backup DMARC records across all your clients — with a compliance dashboard showing DMARC policy status, monitoring for configuration issues, and Hudu documentation syncing built in.

Unified DNS is live — try it free for a month with code FREETRIAL2026 at billing setup. No commitment. Or request a demo for a walkthrough.