DMARC glossary
What does the ri tag mean in a DMARC record?
By Samuel Chenard · CEO & Co-Founder, Palisade · Reviewed July 15, 2026
The ri tag is the requested interval between DMARC aggregate reports, in seconds. The default is 86400 — one report per day. In practice, receivers send daily reports regardless of what you request, and RFC 9989 (the May 2026 DMARC revision) dropped the tag entirely. You can safely leave it out.
ri at a glance | |
|---|---|
| Tag | ri (report interval) |
| Valid values | Interval in seconds, e.g. 86400 (24 hours) |
| Default | Defaults to 86400 — daily aggregate reports. |
| Where it goes | After the reporting tags, e.g. v=DMARC1; p=reject; rua=mailto:dmarc@yourdomain.com; ri=86400; |
How ri works
ri lets you ask receivers to send [aggregate reports](/learning/what-is-a-rua) more or less often than the daily default. The operative word is *ask*: RFC 7489, the spec that defined it, treated it as a request receivers may honor, and in practice the major ones batch and send daily no matter what value you publish. ri=3600 will not get you hourly reports from Gmail.
That makes ri a tag people paste from record generators rather than a lever that does anything. RFC 9989 dropped it from the spec entirely in May 2026, and the IANA registry now lists it as historic. Omit it — and if you inherit a record that sets ri=86400 explicitly, know that removing it changes nothing.
Correct record vs common mistake
Correct
v=DMARC1; p=reject; rua=mailto:dmarc@yourdomain.comNo ri tag — you'll get daily aggregate reports, which is what receivers send anyway.
Common mistake
v=DMARC1; p=reject; rua=mailto:dmarc@yourdomain.com; ri=3600Requests hourly reports; nearly all receivers ignore it and send daily. Harmless, but it signals a copy-pasted record rather than a considered one.
Generate your DMARC record
Build the exact TXT record to publish — pick a policy, add a reporting address, copy. Free, no signup.
Used to show the exact host name to publish — the record itself doesn't contain it.
Start at none to observe, then tighten once reports look clean.
Where daily XML summaries are sent. Comma-separate multiple addresses.
Advanced options (sp, alignment, ruf)
Subdomains inherit p unless you set this. Attackers love unused subdomains — reject is a strong choice once you're at enforcement.
Relaxed allows subdomain matches (mail.yourdomain.com signs for yourdomain.com). Strict requires an exact match — most domains should stay relaxed.
Same idea for the SPF (Return-Path) domain.
Per-message failure samples. Rarely sent by large providers; contains message data.
Your DMARC record
Publish this as a TXT record in your DNS.
_dmarc.yourdomain.comv=DMARC1; p=none;Click the record to select all of it.
Record type: TXT · TTL: your provider’s default (e.g. 3600) is fine.
After you publish
- Add the TXT record at your DNS host and allow up to an hour for propagation.
- Verify it with the free DMARC checker.
- Watch your aggregate reports, fix SPF and DKIM for every legitimate sender, then step up to quarantine and reject.
Troubleshooting ri
| Issue | Likely cause | Fix |
|---|---|---|
| Reports arrive daily despite ri=3600 | Receivers treat ri as a request and batch daily anyway | Expected behavior — remove the tag and work with the daily cycle |
| No reports arriving at all | The problem is the rua= address, not ri — missing, mistyped, or a mailbox rejecting XML attachments | Fix the rua= address; ri has no bearing on whether reports are sent |
| Record generator inserted ri=86400 automatically | Generators often emit every tag with its default value | Safe to remove — an explicit default changes nothing |
Why it matters for MSPs
ri itself breaks nothing — the risk is what it signals. Records across a client base padded with inert tags usually mean they were generated once and never reviewed. If ri=3600 survived an audit, so did whatever actually matters, like a pct stuck at 25 or an sp=none.
Trusted by MSPs
“We moved all our clients from EasyDMARC, which gave us so much more clarity about what to do with the remediation option from the agent.”
Jodie Kretzer — VP of Service Management, Invision Technologies
DMARC software that does the work
Palisade doesn't wait on report cadence tricks — it continuously processes each client domain's aggregate reports as they arrive and advances the policy on the evidence, whatever interval the receivers chose.
1 domain free up to 1,000 emails/month
Questions readers ask