A DMARC policy is a TXT record at _dmarc.example.com. Use a DMARC checker or DNS TXT query, confirm that one valid policy record returns, then read the tags.
dig TXT _dmarc.example.com
Resolve-DnsName _dmarc.example.com -Type TXT
Important tags
| Tag | Meaning | Check |
|---|---|---|
v | Protocol version | DMARC1 and first in the record |
p | Requested policy | none, quarantine, or reject |
sp | Subdomain policy | Match actual subdomain sending |
rua | Aggregate reports | Use a destination that processes XML |
ruf | Failure reports | Provider support varies; review privacy |
adkim | DKIM alignment | Relaxed or strict |
aspf | SPF alignment | Relaxed or strict |
Policies
p=none requests monitoring. p=quarantine asks receivers to treat failing mail as suspicious. p=reject asks them to reject failing mail. Receiver policy still matters, so no value guarantees a particular folder or outcome.
Alignment in plain English
DMARC passes when SPF or DKIM passes and aligns with the domain visible in From. SPF compares the From domain with the authenticated envelope domain. DKIM compares it with the signing domain. Relaxed mode permits the same organizational domain. Strict mode requires an exact match.
A message can pass SPF but fail DMARC when the authenticated domain does not align. A valid DKIM signature can fail DMARC for the same reason.
Current status of pct
Older guidance used pct to request percentage application. RFC 9989 removed it because implementations were inconsistent. Mailthentic still displays it in older records, but new rollout plans should not depend on it.
Reports and enforcement
Aggregate reports summarize authentication results. Failure reports can include message-related data, are not sent consistently, and require privacy review.
- Inventory every legitimate sender.
- Publish a valid monitoring record with aggregate reporting.
- Fix SPF or DKIM alignment.
- Test enforcement on a controlled stream or subdomain.
- Move to quarantine and reject only when legitimate mail aligns.
- Keep reviewing reports after enforcement.
Common errors
- No record: publish one TXT record at the exact name.
- Multiple records: consolidate them.
- Missing policy: add a valid
pvalue. - No reports: check destination authorization and provider support.
- Legitimate failures: inspect alignment before increasing enforcement.
Investigate underlying methods with the SPF checker, DKIM checker, and combined domain health check.
Source
Interpretation follows RFC 9989. Last reviewed 2026-07-31.
Read your policy
Run the DMARC Checker before changing enforcement.
Ready to verify your email list?
Start free with 50 verification credits. No credit card required.