Anatomy of a DMARC record: every tag explained

A DMARC record is a DNS TXT record published at _dmarc.yourdomain.com, composed of semicolon-separated tag=value pairs. Only two tags are required, a handful are useful, and several exist mainly to be explained and then left at their defaults. This entry walks through the complete record, tag by tag, and ends with the minimal record every deployment should start from.

The required tags

v is the protocol version, always DMARC1, and it must come first. p is the policy for the domain: none, quarantine, or reject. Those two tags make a syntactically valid record. A record without rua provides no visibility, though, so in practice rua should always be included as well.

The full tag reference

The table covers every tag, but most records use only a handful. A production record typically carries v, p, rua, and sometimes sp; everything else earns its place only with a specific reason. Extra tags are not harmless decoration: every deviation from defaults is something the next engineer has to understand before touching the record.

Tags that changed with DMARCbis

DMARCbis, the Standards Track revision finalized in 2025, retired pct: percentage-based rollout was implemented inconsistently by receivers and never delivered the gradual enforcement it promised. Records still carrying pct remain valid (receivers ignore unknown or retired tags), but any pct-based rollout plan should be replaced with the staged policy progression. The revision also added np, the policy for non-existent subdomains, which lets a record refuse mail from fabricated names while real subdomains stay at a gentler policy.

The minimal starting record

This record does two things: it tells receivers a DMARC policy exists (even though none takes no action), and it tells them where to send aggregate reports so the domain owner can see who is sending mail as that domain. From here, the rollout process walks the policy toward enforcement, guided by the aggregate reports that start arriving within a day or two.

Placement and syntax rules

The record lives at the _dmarc label under the domain the From: header uses: _dmarc.yourdomain.com for yourdomain.com. One DMARC record per name; duplicates make the policy unusable, the same failure mode as duplicate SPF records. Tags are separated by semicolons, the v tag leads, and unknown tags are ignored rather than fatal, which is why DMARCbis additions deploy safely. When reports should go to an address on a different domain, the receiving domain must authorize it by publishing a verification record (yourdomain.com._report._dmarc.reportingdomain.com with value v=DMARC1), without which receivers will not send reports there.