DMARC ties SPF and DKIM to the address people actually see, the From header, and tells receivers what to do with mail that fails, plus where to send reports.
_dmarc.google.com. 300 IN TXT "v=DMARC1; p=reject; rua=mailto:[email protected]" ; DMARC policy p=reject, sends aggregate reports
_dmarc.github.com. 163 IN TXT "v=DMARC1; p=quarantine; sp=reject; pct=100; rua=mailto:[email protected]; ruf=mailto:[email protected]; fo=1" ; DMARC policy p=quarantine, sp=reject, sends aggregate reports
_dmarc.paypal.com. 179 IN TXT "v=DMARC1; p=reject; rua=mailto:[email protected],mailto:[email protected]; ruf=mailto:[email protected],mailto:[email protected]" ; DMARC policy p=reject, sends aggregate reports
_dmarc.gmail.com. 350 IN TXT "v=DMARC1; p=none; sp=quarantine; rua=mailto:[email protected]" ; DMARC policy p=none, sp=quarantine, sends aggregate reports
A message passes DMARC when SPF or DKIM passes and the domain that passed is aligned with the From domain: the same organizational domain in relaxed mode, or exactly the same in strict mode. Receivers find the policy at _dmarc.<From domain>, falling back to _dmarc.<organizational domain>.
The policy is one TXT record starting with v=DMARC1. Receivers send daily aggregate XML reports to the rua addresses. Those reports show every IP that sent mail as your domain and whether it passed, which is how you get from p=none to p=reject without losing legitimate mail. Report addresses on another organization's domain must be authorized by a record at <your-domain>._report._dmarc.<their-domain>.
_dmarc.example.com. 3600 IN TXT "v=DMARC1; p=quarantine; rua=mailto:[email protected]; adkim=r; aspf=r"Wire format: Stored as a TXT record at the _dmarc label. Tag-value pairs are separated by semicolons; whitespace around them is ignored.
| Field | Meaning |
|---|---|
| v | DMARC1, first. |
| p | Required. none (monitor), quarantine (treat as suspicious) or reject. |
| sp | Policy for subdomains; defaults to p. |
| pct | Share of failing mail the policy applies to, 0-100, default 100. |
| rua | Comma-separated mailto: URIs for aggregate reports, optionally with a size limit (!10m). |
| ruf | URIs for per-message failure reports. Few large receivers send them. |
| adkim / aspf | Alignment mode for DKIM and SPF: r relaxed (default) or s strict. |
| fo | Failure-report trigger: 0 all fail (default), 1 any fails, d DKIM, s SPF. |
| ri | Requested aggregate interval in seconds, default 86400. |
p=none for years: spoofed mail is still delivered.p=reject before a third-party sender (CRM, ticketing, invoicing) signs with an aligned DKIM key._report._dmarc authorization record.