DMARC (Domain-based Message Authentication, Reporting & Conformance) tells receiving servers how to handle emails that fail SPF or DKIM checks. It's the final layer of email authentication that protects your domain from spoofing.
Without a DMARC record, receiving mail servers don't know how to handle emails that fail SPF or DKIM checks. Adding DMARC is essential for protecting your domain from being spoofed and improving deliverability.
DMARC is added as a TXT record at _dmarc.yourdomain.com. Here's how to add it:
Start with monitoring mode to see reports without affecting delivery:
v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.comdmarc-reports@yourdomain.com with your actual email address. This is where you'll receive aggregate reports about your email authentication.A DMARC policy of p=none is "monitoring only" mode. It tells receiving servers to send reports but take no action against emails that fail authentication. While this is a good starting point, it provides no protection against spoofing.
Monitor only. Collect reports to understand your email flow.
Failed emails go to spam. Catches spoofing while allowing review.
Failed emails are rejected outright. Maximum protection.
Step 1: Move to quarantine with gradual rollout
v=DMARC1; p=quarantine; pct=10; rua=mailto:dmarc-reports@yourdomain.comThis applies quarantine to only 10% of failing emails, letting you test safely.
Step 2: Increase percentage over time
v=DMARC1; p=quarantine; pct=50; rua=mailto:dmarc-reports@yourdomain.comStep 3: Full quarantine
v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@yourdomain.comStep 4: Move to reject (after monitoring)
v=DMARC1; p=reject; rua=mailto:dmarc-reports@yourdomain.comThe pct=0 tag means your DMARC policy applies to 0% of emails—effectively disabling it. This is sometimes set accidentally or left over from testing.
pct=0, your domain has no protection from spoofing even if you have a p=reject policy.Either remove the pct tag entirely (defaults to 100%) or set it to a meaningful value:
Before (disabled):
v=DMARC1; p=quarantine; pct=0; rua=mailto:dmarc@example.comAfter (enabled):
v=DMARC1; p=quarantine; rua=mailto:dmarc@example.comOr use gradual rollout:
v=DMARC1; p=quarantine; pct=25; rua=mailto:dmarc@example.comThe rua tag specifies where to send aggregate DMARC reports. Without it, you won't receive visibility into who is sending email as your domain or how many emails are failing authentication.
Add the rua tag to your DMARC record:
Before (no reporting):
v=DMARC1; p=quarantineAfter (with reporting):
v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@yourdomain.comDMARC aggregate reports are XML files sent daily by receiving mail servers. They contain:
You can send reports to multiple addresses:
v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com,mailto:dmarc@dmarcanalyzer.comyourdomain.com._report._dmarc.analyzerdomain.com.| Tag | Required | Description |
|---|---|---|
| v=DMARC1 | Yes | Version identifier (must be first) |
| p= | Yes | Policy: none, quarantine, or reject |
| rua= | No | Aggregate report email address |
| ruf= | No | Forensic report email address |
| pct= | No | Percentage of emails to apply policy (default: 100) |
| sp= | No | Subdomain policy (inherits from p= if not set) |
| adkim= | No | DKIM alignment: r (relaxed) or s (strict) |
After making changes, use our checker to confirm everything is configured correctly.