DMARC glossary
What does the rf tag mean in a DMARC record?
By Samuel Chenard · CEO & Co-Founder, Palisade · Reviewed July 15, 2026
The rf tag declares the report format for failure (forensic) reports sent to your ruf= address. The only registered value is afrf — which is also the default — so the tag never changes anything. It's effectively vestigial: safe to omit, and RFC 9989 dropped it from the spec entirely in May 2026.
rf at a glance | |
|---|---|
| Tag | rf (report format) |
| Valid values | afrf — the only registered value (Authentication Failure Reporting Format, RFC 6591) |
| Default | Defaults to afrf — identical behavior with or without the tag. |
| Where it goes | Near the reporting tags, e.g. v=DMARC1; p=reject; ruf=mailto:forensics@yourdomain.com; rf=afrf; |
How rf works
When DMARC was designed, the rf tag left room for multiple failure-report formats. Only one was ever registered: afrf, the Authentication Failure Reporting Format. Since afrf is both the only option and the default, publishing rf=afrf is a no-op — and publishing anything else asks for a format receivers can't produce.
Add that [forensic reports](/learning/what-is-a-ruf) are rarely sent at all — most receivers decline for privacy reasons — and rf becomes a tag with no practical effect in any direction. RFC 9989 removed it. If a generator put it in your record, it's safe to delete; if it's absent, don't add it.
Correct record vs common mistake
Correct
v=DMARC1; p=reject; rua=mailto:dmarc@yourdomain.com; ruf=mailto:forensics@yourdomain.comNo rf tag — afrf is the default and the only format anyway. This is the record with the dead weight removed.
Common mistake
v=DMARC1; p=reject; ruf=mailto:forensics@yourdomain.com; rf=iodefiodef was never registered as a DMARC failure-report format — no receiver can honor this. Omit the tag instead.
Generate your DMARC record
Build the exact TXT record to publish — pick a policy, add a reporting address, copy. Free, no signup.
Used to show the exact host name to publish — the record itself doesn't contain it.
Start at none to observe, then tighten once reports look clean.
Where daily XML summaries are sent. Comma-separate multiple addresses.
Advanced options (sp, alignment, pct, ruf)
Subdomains inherit p unless you set this. Attackers love unused subdomains — reject is a strong choice once you're at enforcement.
Relaxed allows subdomain matches (mail.yourdomain.com signs for yourdomain.com). Strict requires an exact match — most domains should stay relaxed.
Same idea for the SPF (Return-Path) domain.
Applies quarantine/reject to a percentage of failing mail during rollout. Retired in DMARCbis — use briefly if at all.
Per-message failure samples. Rarely sent by large providers; contains message data.
Your DMARC record
Publish this as a TXT record in your DNS.
_dmarc.yourdomain.comv=DMARC1; p=none;Click the record to select all of it.
Record type: TXT · TTL: your provider’s default (e.g. 3600) is fine.
After you publish
- Add the TXT record at your DNS host and allow up to an hour for propagation.
- Verify it with the free DMARC checker.
- Watch your aggregate reports, fix SPF and DKIM for every legitimate sender, then step up to quarantine and reject.
Troubleshooting rf
| Issue | Likely cause | Fix |
|---|---|---|
| Validator flags an unknown rf value | A non-registered format (like iodef) was published — only afrf exists | Remove the rf tag entirely; the default is correct |
| rf=afrf present but no failure reports arrive | rf doesn't cause reports — most receivers don't send forensic reports regardless | Check that ruf= is set if you want them, and expect sparse participation either way |
| Generator keeps adding rf=afrf to new records | Legacy tooling emits every tag with defaults filled in | Strip it during review — explicit defaults are clutter, not configuration |
Why it matters for MSPs
Like ri, rf is harmless in itself — the multi-tenant cost is clutter. Fifty client records padded with vestigial tags are fifty records that are harder to audit at a glance, and the tags that matter (p, sp, pct) hide in the noise.
Trusted by MSPs
“We moved all our clients from EasyDMARC, which gave us so much more clarity about what to do with the remediation option from the agent.”
Jodie Kretzer — VP of Service Management, Invision Technologies
DMARC software that does the work
Palisade keeps client DMARC records lean and evidence-driven: the tags that enforce, the reporting that feeds the automation, and none of the vestigial padding that makes hand-maintained records hard to audit.
1 domain free up to 1,000 emails/month
Questions readers ask