What is a DMARC record ?
DMARC stands for “Domain-based Message Authentication, Reporting & Conformance.” DMARC is built upon two other authentication protocols: SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail). DMARC policy tells a receiving server how to handle an incoming email claiming to be coming from a particular domain.
Publishing a DMARC record protects your brand by ensuring that email is properly authenticating against DKIM and SPF standards, and that any fraudulent activity appearing to come from your domain is timely blocked.
How to create a DMARC record
You can configure DMARC by adding policies to your domain’s DNS as TXT records. The TXT record read as “_dmarc.your_domain.com.” You need to replace your_domain.com with your domain for which you are creating the DMARC record.
Here are common tags used in DMARC TXT records:
| Tag Name | Required | Purpose | Sample |
| v | required | Protocol version | v=DMARC1 |
| p | required | Policy for domain | p=reject (or quarantine or none) |
| pct | removed | Removed in DMARCbis (RFC 9989); was the % of messages filtered - modern receivers ignore it | - |
| rua | optional | Reporting email address of aggregate reports | rua=mailto:name@your_domain.com |
| ruf | optional | Addresses to which message-specific forensic information is to be reported (comma-separated plain-text list). | ruf=mailto:name@your_domain.com |
| rf | removed | Removed in DMARCbis (RFC 9989) | - |
| aspf | optional | Alignment mode for SPF | aspf=r |
| sp | optional | Policy for existing subdomains | sp=reject |
| adkim | optional | Alignment mode for DKIM | adkim=r |
| np | optional | Policy for non-existent subdomains (added in DMARCbis, RFC 9989) | np=reject |
| t | optional | Testing flag (DMARCbis) - t=y applies your policy one level below | t=y |
| ri | removed | Report interval - removed in DMARCbis (RFC 9989); the pair to rf | - |
| fo | optional | Failure-reporting options (still valid) | fo=1 |
| psd | optional | Public-suffix declaration (DMARCbis, RFC 9989): y / n / u | psd=n |
You can generate your DMARC record using any of the tools available online. Once you have generated the record you would need a TXT record in your domain’s DNS.
Contact us if you need help generating or setting the DMARC record.