DMARC

DMARC (RFC 9989, “DMARCbis”) tells receivers what to do with mail that fails SPF and DKIM alignment, and where to send reports. The policy is published as a TXT record at _dmarc.<domain>.

Recommended rollout (RFC 9989 §7.4): start with p=none plus rua reporting and monitor for at least a month, move to p=quarantine for an equally long period, then finish with p=reject. Plan for more time than that – RFC 9989 §5.1.7 notes that working through the reports can take many months. Only p=quarantine and p=reject ask receivers to act at all, and p=reject is the strongest signal a domain owner can send – but it is not absolute protection: §7.4 forbids receivers to reject on a p=reject policy alone, and forged display names on a foreign sender domain are outside what DMARC covers (§11.4). The security check still rates p=none as a failure, because it asks receivers for nothing.

DMARCbis removed the pct, ri and rf tags and the !size suffix; this generator never emits them. The t=y test flag replaces only the pct=0 idiom (RFC 9989 App. A.6) – partial quotas such as pct=50 have no successor at all.

Domain

Policy (p=)

none – monitoring only; the recommended first step

quarantine – failing mail is treated as suspicious (spam folder)

reject – receivers are asked to refuse failing mail (strongest policy)

Aggregate reports (rua=)

Email addresses, comma-separated; converted to mailto: URIs with , and ! percent-encoded.

Failure reports (ruf=, optional)

Per-message failure reports; few receivers send them.

Subdomain policy (sp=)

Both this tag and np= below are read from the record of the organizational domain (or of a public suffix domain), not from a record beneath it – RFC 9989 §4.7 and §4.10.1. If this name sits below a domain that publishes its own DMARC record, the tags stay in your record but receivers never act on them; the subdomain policy belongs in that higher record instead. Which name counts as the organizational domain is decided by the DNS tree walk in §4.10, so leave both on “inherit” unless you know this record is the one receivers will land on.

Policy for non-existent subdomains (np=)

DKIM alignment (adkim=)

SPF alignment (aspf=)

t=y – test mode. Warning: receivers apply the policy one level weaker (reject → quarantine, quarantine → none). Our BIMI check also treats a record in test mode as not enforcing.

Records are built in your browser; “Load current record” has our server look up your domain’s DNS. Record Studio · What every tag means, in depth · Verify the result with the domain security check · Read your aggregate reports