DMARC record tags and syntax, explained

A DMARC record is one TXT record at _dmarc.yourdomain, made of tag=value pairs separated by semicolons. The first tag must be v=DMARC1, and p= must come next. A domain may publish only one DMARC record; two make both invalid.

v: always DMARC1.

p: the policy for the domain. none, quarantine or reject.

rua: where to send aggregate reports, as a mailto: address. Separate several with commas. If the address is on a different domain, that domain must publish a record authorizing it, which a reporting service handles for you.

sp: the policy for subdomains. If you leave it out, subdomains follow p. Setting sp=reject while p=none lets you protect subdomains that never send mail.

pct: the percentage of failing mail the policy applies to, from 0 to 100. It is a way to ramp up: pct=25 applies quarantine to a quarter of failing mail. Support among receivers varies, so treat it as a guide, not a guarantee.

adkim and aspf: alignment mode for DKIM and SPF. r (relaxed, the default) allows a subdomain to align with the organizational domain. s (strict) requires an exact match.

fo: which failures trigger forensic reports. 0 (default) reports when everything fails, 1 when anything fails, d for DKIM failures, s for SPF failures.

ri: the reporting interval requested, in seconds. The default is 86400 (one day). Most receivers send daily whatever you ask.

ruf names an address for failure reports about individual messages. Many large receivers do not send them because they can contain personal data, so do not rely on them. Aggregate reports are the dependable source.

A space or quote in the wrong place, a missing semicolon, p= before v=, a second DMARC record added instead of editing the first, and a rua address on another domain with no authorization record. A checker will catch all of these.