DMARC glossary
What does the pct tag do in a DMARC record?
By Samuel Chenard · CEO & Co-Founder, Palisade · Reviewed August 16, 2026
The pct tag was a partial-enforcement control in RFC 7489. RFC 9989 removed it in May 2026 because receivers implemented sampling inconsistently. New DMARC records should omit pct; use aggregate reports, whole-policy changes, and lower-volume subdomains to stage enforcement.
pct at a glance | |
|---|---|
| Tag | pct (historic percentage tag) |
| Valid values | Historic in RFC 9989 — omit from new records |
| Default | No pct tag means the published policy applies without percentage sampling. |
| Where it goes | Legacy records placed it after p; current records should remove it after reviewing interoperability. |
How pct works
Under the superseded RFC 7489 model, pct=25 asked receivers to apply the published quarantine or reject policy to roughly one quarter of messages that failed DMARC and use a softer disposition for the rest.
That behavior was never reliable enough to use as a safety control: receivers could honor, round, or ignore the requested percentage. RFC 9989 therefore moved pct to historic status and excluded it from the active DMARC tag set.
For an existing record, do not assume that deleting pct is risk-free just because the tag is historic. Review aggregate reports first, fix every legitimate sender, then remove the tag or step the whole policy back if you still need a safety boundary.
Correct record vs common mistake
Correct
v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.comCurrent RFC 9989 form: full quarantine with aggregate reporting and no legacy sampling tag.
Common mistake
v=DMARC1; p=reject; pct=10A legacy partial-enforcement record. Different receivers may handle pct differently, so the advertised policy does not produce a dependable outcome.
Generate your DMARC record
Build the exact TXT record to publish — pick a policy, add a reporting address, copy. Free, no signup.
Used to show the exact host name to publish — the record itself doesn't contain it.
Start at none to observe, then tighten once reports look clean.
Where daily XML summaries are sent. Comma-separate multiple addresses.
Advanced options (sp, alignment, ruf)
Subdomains inherit p unless you set this. Attackers love unused subdomains — reject is a strong choice once you're at enforcement.
Relaxed allows subdomain matches (mail.yourdomain.com signs for yourdomain.com). Strict requires an exact match — most domains should stay relaxed.
Same idea for the SPF (Return-Path) domain.
Per-message failure samples. Rarely sent by large providers; contains message data.
Your DMARC record
Publish this as a TXT record in your DNS.
_dmarc.yourdomain.comv=DMARC1; p=none;Click the record to select all of it.
Record type: TXT · TTL: your provider’s default (e.g. 3600) is fine.
After you publish
- Add the TXT record at your DNS host and allow up to an hour for propagation.
- Verify it with the free DMARC checker.
- Watch your aggregate reports, fix SPF and DKIM for every legitimate sender, then step up to quarantine and reject.
Troubleshooting pct
| Issue | Likely cause | Fix |
|---|---|---|
| Spoofed mail still reaching inboxes at p=reject | A legacy pct tag may be weakening or varying the requested disposition | Confirm legitimate senders are clean in aggregate reports, then remove pct after an interoperability review |
| Different receivers handle the same record differently | pct was implemented unevenly and is now historic | Do not treat pct as a dependable control; migrate to whole-policy changes and report-driven gates |
| Domain stuck at a low pct for months | A legacy rollout step became permanent | Re-check reports for unaligned senders, fix them, remove pct, and finish at full enforcement |
Why it matters for MSPs
A legacy pct tag makes a portfolio audit ambiguous. A domain can advertise p=reject while receivers apply different handling to the same failing traffic. Inventory the full record, review each domain's reports, and migrate away from pct deliberately.
Trusted by MSPs
“Using Palisade made it easy to ramp up our email marketing channel from 0 to 100 in no time”
Bobby Ghoshal — CEO, dupe.com
DMARC software that does the work
Palisade reads each domain's aggregate reports, confirms legitimate senders are aligned, removes legacy partial-enforcement state deliberately, and advances the whole policy to reject without relying on pct sampling.
1 domain free up to 1,000 emails/month
Questions readers ask