DMARC tags explained: p, sp, pct, rua, ruf, fo, adkim, aspf

What it means

A DMARC record is a TXT record at _dmarc.yourdomain.com. It is made of tags: short names followed by = and a value, separated by semicolons. For example:

v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com; adkim=r; aspf=r

Only v and p are required. The others are optional and have default values.

Why it matters

A wrong tag can make your record useless, or stop reports from arriving. A misunderstood tag can also block your own emails. Knowing what each part does lets you change your policy safely.

The tags one by one

Required

• v=DMARC1: the version. It must come first, written exactly like this.
• p: the policy for emails that fail DMARC. none means only watch, quarantine means send to spam, reject means refuse the email.

Reports

• rua: where to send aggregate reports, daily summaries of who sent email with your domain. Example: rua=mailto:dmarc@yourdomain.com. Strongly recommended.
• ruf: where to send failure reports, copies of single failing emails. Few providers send them today, and they may contain personal data. Most people leave it out.
• fo: when to send failure reports. 0 (default) when everything fails, 1 when anything fails. Only useful with ruf.

Scope

• sp: the policy for subdomains, such as shop.yourdomain.com. Without it, subdomains follow p.
• pct: the percentage of failing emails the policy applies to, from 0 to 100 (default 100). For example p=quarantine; pct=25 quarantines a quarter of failing emails. Useful for a gradual move, but newer DMARC versions are replacing it, so do not rely on it for long.

Alignment

• adkim: how closely the DKIM domain must match the From domain. r (relaxed, default) accepts subdomains; s (strict) needs an exact match.
• aspf: the same, for the SPF domain (the Return-Path).

Keep both on relaxed unless you have a good reason: strict mode often breaks newsletter tools that use a subdomain.

How to check

• Use the Domain scanner: type your domain at /domain-scanner to read your DMARC record and its tags.
• Send a test email: on the home page, copy your unique test address, send it a normal email from the mailbox or tool you want to check, then open the report. The DMARC line shows the result and the policy applied.

Safe records for each stage

Starting out, only watching:

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

Once reports show all your senders pass:

v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com

Full protection, subdomains included:

v=DMARC1; p=reject; sp=reject; rua=mailto:dmarc@yourdomain.com

Common mistakes

• Forgetting mailto: before the report address.
• Commas instead of semicolons between tags.
• Two DMARC records at the same name: receivers ignore both.
• Sending reports to a domain other than your own without the authorisation record that this requires.

Check that it is fixed

DNS changes are not instant. Most are visible within a few minutes, but some providers take up to 24 to 48 hours. Run the Domain scanner again: the DMARC record should be read without errors and show the tags you set.