DMARC policies and tags
How alignment, reporting and p=none/quarantine/reject work together.
Definition and scope
How alignment, reporting and p=none/quarantine/reject work together.
Use this reference to establish the meaning and limits of the result before changing production configuration.
How it works
DMARC evaluates whether authenticated SPF or DKIM aligns with the visible From domain. A domain publishes one TXT record at _dmarc. The p tag sets the requested handling, while rua receives aggregate reports.
How to read it
p=none observes, quarantine asks receivers to treat failures suspiciously, and reject requests rejection. pct limits the percentage covered; sp controls subdomains. Strict alignment uses adkim=s or aspf=s, while relaxed alignment accepts organizational-domain matches.
Correct and incorrect examples
Compare the normalized examples. Technical values are illustrative and use documentation ranges or reserved names.
v=DMARC1; p=quarantine; pct=100; rua=mailto:dmarc@example.com_dmarc.example.com TXT "v=DMARC1"| Element | Role | Example |
|---|---|---|
| p | p= | none | quarantine | reject |
| sp | sp= | reject |
| pct | 0…100 | 100 |
| rua | URI | mailto:dmarc@example.com |
| adkim / aspf | r | s | r |
Common problems
Multiple records, a missing p tag, malformed mailto URIs and moving to reject before reviewing reports cause failures. Passing SPF alone is insufficient when its authenticated domain does not align with From.
Practical checklist
Start with reporting, identify legitimate senders, correct SPF/DKIM alignment, then increase enforcement deliberately. Keep one record and monitor reports after every provider or DNS change.
Standards and primary references
These primary specifications define the protocol behavior. Provider documentation may add operational requirements but cannot replace the standard.