Learn · Email authentication
DMARC Record: Format, Examples & How to Add One
A DMARC record is one line of DNS that tells email receivers what to do with mail that pretends to be from your domain — and where to send you the proof that it happened. It lives in a single TXT record at _dmarc.yourdomain.com. If you're new to the whole chain, SPF, DKIM & DMARC explained covers how the three fit together first.
The DMARC record format
The DMARC record is made up of several tags separated by a semicolon. While there are many available tags, the ones you'll actually use are:
- v=DMARC1 — the "version" tag. Required, and always first in a DMARC record.
- p= — the policy tag: what should an email receiver do with a message that does not pass SPF and/or DKIM validation — none, quarantine, reject.
- rua= — where should aggregate reports be sent — usually an email address that can receive XML files.
- sp= — policy for subdomains.
- adkim= / aspf= — how aligned the sender's identity must be. Valid values are "r" (relaxed, the default) or "s" (strict).
- np= — policy for non-existent subdomains. This is often considered the simplest way to spoof your domain.
DMARC record examples
Below are three minimal DMARC records. Copy & paste and replace "yourdomain.com" with your actual domain name, and update the "reports@" part to point to wherever you want your reporting service to receive reports.
Minimal monitoring (start here):
v=DMARC1; p=none; rua=mailto:reports@yourdomain.comQuarantine, after your senders align:
v=DMARC1; p=quarantine; rua=mailto:reports@yourdomain.com; sp=quarantine; adkim=s; aspf=sReject all non-senders (full enforcement):
v=DMARC1; p=reject; rua=mailto:reports@yourdomain.com; sp=reject; adkim=s; aspf=s; np=rejectHow to add your DMARC record to DNS
- Log into your DNS provider's control panel and select "Add New Record".
- Select "TXT".
- Enter the following information: "
_dmarc" in the host field, and paste the entire DMARC record value in the value field, including quotes if requested. - Set the TTL (time to live) to however long your provider defaults.
Once you've added the record, it'll take anywhere from a few minutes to a few hours to reach most major email providers. You won't need to change anything else about your email configuration — DMARC simply adds a layer of protection on top of what you already have.
The one mistake that breaks everything: never publish more than one DMARC record. Receivers that find multiple records ignore all of them — no policy, no reports, no protection, and you'd never know. Keep exactly one TXT record at _dmarc.yourdomain.com.
Free checks: DMARC checker SPF checker DKIM checker Spam checker
Want to check the record you just published? Run the free DMARC checker — it reads your live DNS and tells you if the record parses, what policy it enforces, and what's still missing. For the full walk from p=none to p=reject, see DMARC policies explained.