DMARC tags
A DMARC record is a list of semicolon-separated tags. Only v and
p are required; everything else has a default, and the defaults are usually right.
| Tag | Purpose | Default | Values |
|---|---|---|---|
v |
Declares the record as DMARC. Must be the first tag, spelled exactly v=DMARC1. | required | DMARC1 |
p |
What a receiver should do with mail that fails DMARC. | required | none | quarantine | reject |
sp |
A separate policy for subdomains. | inherits p | none | quarantine | reject |
rua |
Where daily XML summaries of authentication results are sent. | — | comma-separated mailto: URIs |
ruf |
Where per-message failure reports are sent. | — | comma-separated mailto: URIs |
pct |
What share of failing mail the policy applies to. | 100 | 0-100 |
adkim |
How closely the DKIM signing domain must match the From: domain. | r | r (relaxed) | s (strict) |
aspf |
How closely the SPF domain must match the From: domain. | r | r (relaxed) | s (strict) |
fo |
Which failures trigger a forensic report. | 0 | 0 | 1 | d | s |
ri |
How often you would like aggregate reports. | 86400 | seconds |
rf |
The format for forensic reports. | afrf | afrf |
np |
A policy specifically for subdomains that have no DNS records at all. | inherits sp, then p | none | quarantine | reject |