DNS Record Explainer

v=DMARC1
Protocol version. Always "DMARC1" for DMARC records. This must be the first tag.

p=none
Policy action. Tells receivers what to do with mail that fails DMARC checks. "none" means monitor only—don't reject or quarantine, just send reports. Other valid values are "quarantine" (move to spam) and "reject" (bounce the message). You're currently in reporting/audit mode.

rua=mailto:[email protected]
Reporting URI for aggregate reports. Receivers send you weekly XML summaries of authentication results (SPF/DKIM pass/fail rates, sources of mail claiming your domain). This goes to [email protected]. You can add multiple addresses with commas: rua=mailto:[email protected],mailto:[email protected]

• Missing ruf tag. You have aggregate reporting (rua) but no forensic reporting (ruf). Forensic reports show individual message failures with headers. Add ruf=mailto:[email protected] if you want to investigate specific failures. Optional but useful when moving from p=none to stricter policies.

• p=none + weak foundation risk. Before enforcing (p=reject), verify your legitimate mail sources pass SPF or DKIM. If you don't have an SPF record or DKIM signing yet, tighten slowly: none → quarantine → reject. Check your aggregate reports first to see who's failing.

• Missing subdomain policy. This record applies to @example.com only. Add sp=quarantine or sp=reject to set a separate stricter policy for subdomains if needed. Otherwise subdomains inherit the main policy.

• Consider adding fo=1 tag. Controls which authentication failures generate forensic reports (if you add ruf). fo=1 sends reports for any DKIM or SPF failure. Default is fo=0:1 (DKIM failures only).

DMARC works with SPF and DKIM to prevent domain spoofing. Receivers check if the From header domain's DMARC policy exists, evaluate whether mail passed SPF/DKIM alignment, then act accordingly. Without this record, receivers have no instruction and mail is vulnerable to spoofing. The aggregate reports let you see authentication health across all your mail sources before you enforce rejection.

→ /tools/dmarc-checker run the live checker on a real domain → /blog/dmarc-policies-explained