What is a DMARC record?

Definition

A DMARC record is a DNS TXT record published at the name _dmarc.yourdomain.com. Receivers that get mail claiming to be from your domain look it up automatically, and it tells them two things: what to do when a message fails DMARC, and where to send reports about what they saw. A minimal, safe first record looks like this:

_dmarc.example.com.   3600   IN   TXT   "v=DMARC1; p=none; rua=mailto:reports@example.com"

The tags that matter

• v=DMARC1 identifies the record; it must come first.
• p= is your policy for failing mail: none (report only), quarantine, or reject.
• rua= is where aggregate reports go. Without it you are flying blind; it is the tag that makes DMARC observable.
• sp= optionally sets a different policy for subdomains; unset, they inherit p=.
• aspf= / adkim= switch alignment between relaxed (default) and strict.

Older tags like pct= (sampling) and ri= (report interval) still parse but were removed in the updated standard; new records should not rely on them.

The rules that bite

• Exactly one record. Two TXT records starting v=DMARC1 at _dmarc invalidate each other; receivers ignore both.
• The name is _dmarc, not the apex. Publishing the policy text at the bare domain does nothing.
• One record covers all subdomains via the organizational domain fallback, so check sp= before assuming subdomains are unprotected.

Record vs results

Publishing the record is the easy 10 percent. The record only declares policy; whether your legitimate mail passes depends on SPF and DKIM being configured and aligned for every service that sends as you. Start at p=none, read the reports, fix the senders they expose, then move up to enforcement.