DMARC Record Syntax Explained: p, pct, rua, ruf and More

A DMARC record is one line of text in your DNS, and it looks like a puzzle at first: v=DMARC1; p=quarantine; pct=25; rua=mailto:dmarc-reports@example.com. Every part has a precise meaning, and a small slip, such as a comma where a semicolon belongs or a missing mailto:, can make receivers ignore a tag or the whole record. People often arrive here from a search such as "dmarc policy p=quarantine rua=" or "p 0 dmarc" after a tool flagged one tag.

This guide is a tag-by-tag reference built on RFC 7489, the DMARC specification. It explains each tag, its allowed values and default, shows complete records, and gives a cautious rollout plan. For the full setup process, use Set Up DMARC: From p=none to Quarantine and Reject. DMARC helps receivers decide what to do with mail that fails authentication; it does not control inbox placement.

Before you begin

Set up SPF and DKIM first. DMARC only evaluates their results. See the SPF record guide and DKIM setup.
List every system that sends mail as your domain, such as website forms and newsletter tools.
Have DNS access. DNS records for a website launch explains TXT records.
Create a mailbox for reports on your own domain, and save your current record so you can go back.

The anatomy of a DMARC record

A DMARC record is a DNS TXT record published at the name _dmarc in front of your domain. For example.com, the name is _dmarc.example.com. The value is a list of tag=value pairs separated by semicolons. RFC 7489 rules explain most syntax problems:

v must be the first tag and must read exactly DMARC1; otherwise the record is discarded. By convention p comes next.
Tags are separated by semicolons. Spaces after a semicolon are ignored.
Receivers ignore tags they do not recognize, so a misspelled tag does nothing.
A domain must have exactly one DMARC record. If a receiver finds more than one at the same name, it discards them all.
If mail.example.com has no record of its own, receivers use the one at the organizational domain, _dmarc.example.com. This matters for sp.

A message passes DMARC when SPF or DKIM passes and the domain that passed lines up (is "aligned") with the domain in the visible From address.

Tag reference at a glance

Tag	Meaning	Allowed values	Default
`v`	Version	`DMARC1`	required, first
`p`	Policy for the domain	`none`, `quarantine`, `reject`	required for a policy record
`sp`	Policy for subdomains	same three values	same as `p`
`pct`	Share of failing mail the policy applies to	whole number 0 to 100	100
`rua`	Aggregate report destinations	comma-separated `mailto:` URIs	no reports
`ruf`	Failure report destinations	comma-separated `mailto:` URIs	no reports
`adkim`	DKIM alignment mode	`r` or `s`	`r`
`aspf`	SPF alignment mode	`r` or `s`	`r`
`fo`	When to create failure reports	`0`, `1`, `d`, `s` (colon-separated)	`0`
`rf`	Failure report format	`afrf`	`afrf`
`ri`	Seconds between aggregate reports	whole number	86400

Step-by-step instructions

Step 1: Look up what is published today

dig +short TXT _dmarc.example.com

On Windows, use nslookup -type=TXT _dmarc.example.com. You should see zero or one record starting v=DMARC1; if you see two, fix that first.

What success looks like: You know whether a record exists and have its exact text.

Step 2: Write the required tags, v and p

p is the policy you ask receivers to apply to mail that fails DMARC:

p=none means monitor only: receivers take no action because of DMARC, and with rua you still get reports.
p=quarantine asks receivers to treat failing mail as suspicious. Many deliver it to spam, but handling is the receiver's choice.
p=reject asks receivers to refuse failing mail during delivery.

A policy is a request, and receivers apply their own judgment. A valid starting record:

v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com

About "p 0": p=0 is not valid. The only values are none, quarantine and reject. If a record has no valid p but a valid rua, RFC 7489 says a receiver should act as if it said p=none; with no valid rua either, the receiver should take no action. What most people mean by "zero" is pct=0, covered next.

What success looks like: The record starts v=DMARC1; p= followed by one of the three words.

Step 3: Decide how much mail the policy covers with pct

pct is a whole number from 0 to 100 and defaults to 100. It is the percentage of failing messages to which the policy should be applied. According to RFC 7489, the rest get the next-weaker treatment:

p=quarantine; pct=25: about a quarter of failing messages are quarantined, and the rest are handled as if the policy were none.
p=reject; pct=25: about a quarter are rejected, and the rest are quarantined.

So pct=100, or no pct, applies your full policy to every failing message. pct=0 applies it to none. With p=quarantine; pct=0, nothing is quarantined, so the record only monitors while looking like enforcement. That mismatch is the usual reason a scan flags pct.

pct is a sampling request that receivers need not follow exactly. A revised specification, often called DMARCbis, has been in development at the IETF and proposes changes to some tags, including how gradual rollout is expressed, so check the current standard and treat pct as a short-term tool.

What success looks like: You can say what share of failing mail your record covers.

Step 4: Set a subdomain policy with sp

Without sp, subdomains follow p. With it:

v=DMARC1; p=reject; sp=quarantine; rua=mailto:dmarc-reports@example.com

asks for rejection of failing mail from example.com and quarantine for failing mail from, say, news.example.com. Use sp when the main domain is ready for enforcement but a sending subdomain is not. Avoid sp=none unless you intend to leave subdomains unprotected. A subdomain with its own _dmarc record follows that record, not sp.

What success looks like: Every sending subdomain is covered by a policy or has its own record.

Step 5: Add aggregate reports with rua

rua lists where to send aggregate reports: compressed XML summaries of the mail receivers saw claiming to be from your domain, with SPF, DKIM and alignment results. Each address must start with mailto:; separate several with commas:

rua=mailto:dmarc-reports@example.com,mailto:reports@analyzer.example.net

Typical errors are a bare address (rua=dmarc-reports@example.com), spaces inside the list, or a semicolon between addresses, which ends the tag.

If an address is on a different domain, receivers are expected to check that it agrees to receive your reports. That domain publishes a TXT record at example.com._report._dmarc.analyzer.example.net (your domain, ._report._dmarc., then the report domain) with the value v=DMARC1. Report services usually tell you the exact record; without it, many receivers will not send reports.

What success looks like: Report files arrive within a few days.

Step 6: Understand ruf, fo and rf

ruf is the counterpart of rua for failure reports (sometimes called forensic reports). A failure report concerns one failed message and may include parts of it. That raises privacy concerns, and many large receivers do not send them, so do not build a plan around ruf data.

v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@example.com; ruf=mailto:dmarc-failures@example.com; fo=1

fo controls when a receiver that supports failure reports creates one. It has an effect only if ruf is present. Values can be combined with colons, as in fo=1:d:s:

0 (default): report when all underlying checks fail to produce an aligned pass, which is when DMARC itself fails.
1: report when any underlying check fails to produce an aligned pass.
d: report when DKIM fails to validate, aligned or not.
s: report when SPF fails, aligned or not.

rf names the report format. Its default, afrf (Authentication Failure Reporting Format), is the only one RFC 7489 defines, so leave rf out. If you use ruf, send it to a restricted mailbox, because messages can contain personal data.

What success looks like: You left these tags out on purpose, or know where their data goes.

Step 7: Choose alignment with adkim and aspf

adkim applies to DKIM and aspf to SPF. Each takes r (relaxed) or s (strict), and both default to r:

Relaxed: the domain that passed only needs to share the same organizational domain as the From address. Mail from news@example.com signed with d=mail.example.com aligns.
Strict: the domains must match exactly. In the same example, it would not align.

v=DMARC1; p=reject; adkim=s; aspf=r; rua=mailto:dmarc-reports@example.com

Strict mode can block legitimate senders that use a subdomain, so keep the relaxed default until reports show every legitimate source would still pass. A third-party service that signs only with its own domain will not align under either mode until you configure it to use yours.

What success looks like: Reports confirm real senders still pass.

Step 8: Know what ri does, then publish

ri is the number of seconds you would like between aggregate reports; the default is 86400 (one day). Receivers choose their own schedule, so most owners leave ri out.

Edit the TXT record at _dmarc in your DNS panel. Some panels want only _dmarc and add your domain automatically; typing the full name there gives _dmarc.example.com.example.com, which does nothing. Then repeat Step 1.

What success looks like: The lookup returns exactly one record with the text you intended.

A cautious rollout plan

There is no single correct timetable; it depends on how many systems send for you.

Monitor. Publish p=none with rua and read reports long enough to see every regular sender, including rare ones such as a month-end billing run.
Fix senders. Set up DKIM with your own domain, and SPF where needed, for each legitimate source.
Sample enforcement. Move to p=quarantine; pct=10, then raise pct in steps, checking reports each time.
Full quarantine. Remove pct or set pct=100.
Reject. When reports show no legitimate failures, move to p=reject, again optionally starting with a lower pct.
Maintain. Authenticate every new email tool before it goes live. For wider launch checks, see the website launch SEO checklist and the first 30 days after launch.

For a domain that never sends email, publish v=DMARC1; p=reject; together with an SPF record of v=spf1 -all and a null MX record.

Forwarding and mailing lists can make some genuine mail fail even when your setup is correct, so weigh the reports with that in mind.

Crawvix's scan checks "DMARC record is published" and "DMARC policy is enforced and reports are sent". The second one fails when a sending domain's policy is none, when pct=0, or when no valid reporting address is set, and it notes a warning when pct is below 100 or sp=none.

Final verification checklist

Exactly one TXT record exists at _dmarc.yourdomain, starting v=DMARC1; with a valid p.
Tags use semicolons, addresses use commas, and each report address begins with mailto:.
Any report address on another domain has its authorization record, and pct is absent or 100 for full enforcement.
Someone reads the reports before the policy is tightened.

Common mistakes to avoid

Commas between tags. Tags use semicolons; commas separate only addresses inside rua or ruf.
Omitting mailto:. A bare address is not a valid reporting URI.
Treating pct=0 as enforcement. It covers no mail.
Writing p=0 or p=enforce. Only none, quarantine and reject are valid.
Publishing two records. Receivers discard both.
Wrong name. The record belongs at _dmarc, not at the root of the domain.
Strict alignment without evidence. It can block legitimate senders.

Troubleshooting

My lookup returns nothing, or a tool says the record is invalid

Confirm the name is exactly _dmarc.yourdomain, the type is TXT, and your panel did not append the domain twice. Then look for a missing v=DMARC1, curly quotation marks, commas between tags, or an rua without mailto:.

I get no reports

Allow a few days, then check the rua mailbox and any authorization record. Not every receiver sends reports.

Reports show my own mail failing

Open a failing line and see which of SPF and DKIM passed, and for which domain. If a service passes only for its own domain, set it up to sign with yours, as the setup guide describes. If mail reaches spam even though DMARC passes, reputation is a likelier cause; see email blocklist delisting.

A subdomain ignores my policy

Check whether it publishes its own _dmarc record, which overrides the parent. Otherwise check sp.

Frequently asked questions

What does p=quarantine; rua=mailto: mean?

It asks receivers to treat mail that fails DMARC as suspicious and send aggregate reports to the address after mailto:.

What is the difference between rua and ruf?

rua receives aggregate reports covering many messages. ruf receives failure reports about individual messages, which are rare because they can contain message content.

What is the default for pct?

A record without pct applies its policy to all failing mail, pct=0 applies it to none, and values between are a sampling request.

Should I use adkim=s and aspf=s?

Only if every legitimate message passes strict alignment. Relaxed is the default and suits most domains.

Does DMARC replace SPF and DKIM?

No. DMARC reads their results and adds the alignment rule and reporting. For mail in transit, see MTA-STS and TLS-RPT.

Official references

Want to see how a site is checked from the outside? Try the free website sample. This guide provides technical information, not a promise about inbox delivery.