Email DNS Check

DMARC Record Examples

DMARC records are TXT records published at _dmarc.yourdomain.com. They define the policy (p=none, quarantine, or reject), reporting addresses (rua, ruf), and optional tags such as pct and fo. This page shows correct examples for monitoring, gradual enforcement, and full reject, with realistic rua and ruf values.

One-Minute Fix

Start with p=none and a valid rua address. Once you have visibility, move to pct=10 for sampling, then increase enforcement. Use the examples below as templates and replace the mailto address with your own.

Monitoring policy (safe start)
DNS TXT
v=DMARC1; p=none; rua=mailto:dmarc@example.com; ruf=mailto:dmarc@example.com; fo=1

p=none collects data without blocking. rua receives aggregate reports; ruf receives forensic reports when fo=1 triggers them. Replace dmarc@example.com with your reporting mailbox.

Re-check

Wrong vs correct setup

Invalid or incomplete record

Invalid or incomplete record
DNS TXT
v=DMARC1; p=reject

Jumping straight to p=reject without rua means you get no visibility and may block legitimate mail before you finish auditing senders. Add rua and start with p=none.

Enforcement with sampling

Enforcement with sampling
DNS TXT
v=DMARC1; p=quarantine; pct=25; rua=mailto:dmarc@example.com

pct=25 applies quarantine to 25% of failing mail first. Use this during rollout to reduce risk. Increase pct or move to p=reject once you are confident.

Why examples help

Teams often omit rua, use invalid mailto syntax, or move to reject too quickly. Working examples show the right tag order and values for each rollout stage.

Why incorrect examples cause problems

  • Missing rua means no aggregate reports for visibility.
  • Invalid mailto syntax can break report delivery.
  • p=reject without prior monitoring risks blocking real mail.
  • Wrong tag order or typos can invalidate the record.

How correct DMARC records affect deliverability

A staged rollout with valid reporting lets you fix alignment issues before enforcement blocks mail. Correct tag syntax ensures reports arrive and you can make informed policy decisions.

Common record mistakes

  • Copying p=reject before auditing all senders.
  • Omitting rua or using an invalid mailto address.
  • Typos in tag names (e.g. ruo instead of rua).
  • Using pct=0 or omitting pct when sampling is intended.

What we checked

We validate DMARC record structure: required tags, valid mailto URIs, and sensible policy values. We flag records that may block mail prematurely.

Live DNS lookup. No login. No saved domains. No tracking.

FAQ

What is the difference between rua and ruf?

rua receives aggregate reports (daily summaries). ruf receives forensic reports (per-message) when fo=1 triggers them. Both use mailto: addresses.

Can I use multiple rua addresses?

Yes. Separate them with commas: rua=mailto:a@example.com,mailto:b@example.com. Each recipient gets a copy of the aggregate report.

When should I use pct?

Use pct during rollout to apply quarantine or reject to a percentage of failing mail first. Increase gradually to 100.

Next steps

  • Publish a p=none record with rua first.
  • Review aggregate reports for a few weeks.
  • Add pct when moving to quarantine or reject.
  • Replace the mailto address with your real mailbox.
  • Re-check after policy changes.
  • Review the full troubleshooting guidance in the DMARC Hub.
  • Explore sender authorization issues in the SPF Hub.
  • Check signing and selector issues in the DKIM Hub.

Related fixes

Explore more issues