Do I need SPF and DKIM before creating a DMARC record?

You need at least one of them. DMARC passes when either SPF or DKIM passes with proper domain alignment. In practice, you should have both configured before publishing DMARC: SPF covers mail servers you authorise, and DKIM provides a cryptographic signature that survives email forwarding where SPF often breaks.

What is the correct hostname for a DMARC record?

The record must be published at dmarc.yourdomain.com. If your domain is acmecorp.com, the hostname is dmarc.acmecorp.com. Most DNS providers let you enter just dmarc in the host field and automatically append the domain — check your provider's documentation to avoid publishing a duplicate suffix like dmarc.acmecorp.com.acmecorp.com.

Can a domain have more than one DMARC record?

No. RFC 7489 (and its successor RFC 9989) specify that a domain must have exactly one DMARC record. If your DNS query returns two TXT records at dmarc.yourdomain.com, receivers will treat the domain as having no valid DMARC policy and ignore both. Remove duplicates immediately if found.

Back to Resources DMARC Guides

How to create a DMARC record

Q: What does fo=1 do, and should I include it?

fo=1 tells receivers to send a forensic (failure) report when any single authentication mechanism fails, even if DMARC still passes overall. It produces more granular data during the monitoring phase and is worth including in your starting record. Once you reach p=reject and your setup is stable, it is less critical — and note that many large providers have stopped sending ruf forensic reports regardless of the fo setting.

By Taylor TabusaAugust 9, 2023Updated July 17, 20268 min read

Ask AI to explain

In brief

Create a DMARC record step by step: build the TXT record, pick a policy, publish it in DNS, and add reporting so you can safely enforce reject.

To create a DMARC record, add a DNS TXT record named _dmarc.yourdomain.com with the value v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com — then confirm it exists with a DMARC checker and start reading aggregate reports before you enforce a stricter policy.

DMARC (Domain-based Message Authentication, Reporting, and Conformance) is an email authentication protocol that tells receiving mail servers what to do with messages that fail SPF or DKIM checks. Without it, anyone can send email that appears to come from your domain.

What goes into a DMARC record?

A DMARC record is a DNS TXT record published at the subdomain _dmarc.yourdomain.com. It contains tags separated by semicolons. Two tags are required; the rest are optional but important.

Required tags

Tag	Value	Purpose
`v`	`DMARC1`	Must appear first; identifies this as a DMARC record
`p`	`none` / `quarantine` / `reject`	Policy to apply when a message fails authentication

Commonly used optional tags

Tag	Example	Purpose
`rua`	`rua=mailto:dmarc@example.com`	Where to send daily aggregate (XML) reports
`ruf`	`ruf=mailto:dmarc@example.com`	Where to send forensic failure reports (less commonly used)
`sp`	`sp=reject`	Override policy for subdomains; if omitted, subdomains inherit `p=`
`adkim`	`adkim=s`	DKIM alignment: `r` relaxed (default) or `s` strict
`aspf`	`aspf=s`	SPF alignment: `r` relaxed (default) or `s` strict
`fo`	`fo=1`	Failure reporting options; `fo=1` generates a report on any single auth failure
`pct`	`pct=25`	Percentage of failing mail the policy applies to — useful for staged rollout

Note on pct: RFC 9989 (published May 2026, the Standards Track update to RFC 7489) removed the pct tag from the specification. Major providers still honour it for now, but it is not guaranteed to behave consistently across all receivers. Prefer staged rollout through policy escalation (none → quarantine → reject) rather than relying on pct.

How alignment modes work

adkim and aspf control how strictly the From domain must match the authenticated domain:

Relaxed (r, default): The organizational domain must match. mail.example.com aligns with example.com.
Strict (s): An exact match is required. mail.example.com does not align with example.com.

Start with relaxed alignment unless you have a specific reason for strict — it avoids breaking mail sent through subdomains of your domain.

Step-by-step: how to create a DMARC record

Step 1 — Confirm SPF and DKIM are in place

DMARC builds on top of SPF and DKIM. If neither is configured, DMARC has nothing to verify against and every message will fail. Check your current setup with the SPF checker and DKIM checker before proceeding. If you need to set them up first, start with what are DMARC, DKIM, and SPF.

Step 2 — Build your starting record

For a first deployment, use p=none so you collect reports without affecting mail delivery. The minimum viable record is:

Technical exampletext

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

Add fo=1 to get failure reports on any authentication issue, not just complete DMARC failures:

Technical exampletext

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com; fo=1

Use the free DMARC generator to produce a record with the exact tags you need and copy the result.

Step 3 — Publish the TXT record in DNS

Log in to your DNS provider (Cloudflare, GoDaddy, Google Domains, or your registrar's DNS panel) and add a new TXT record:

Field	Value
Type	TXT
Host / Name	`_dmarc` (some providers need the full `_dmarc.yourdomain.com`)
Value	`v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com; fo=1`
TTL	3600 (1 hour) is fine; lower for faster iteration during testing

Save the record. DNS propagation typically completes within minutes to a few hours, though up to 48 hours is possible.

Step 4 — Verify the record is live

Use the DMARC checker or run a DNS lookup for _dmarc.yourdomain.com TXT records. You should see your record returned verbatim.

Two example DMARC TXT records showing a starting none policy and a final reject policy with strict alignment.

Top: a monitoring-only starting record. Bottom: a final enforcement record with strict alignment.

Step 5 — Read reports and fix authentication gaps

Aggregate reports arrive daily (usually as gzip-compressed XML) at the rua address. They show every IP that sent mail claiming to be from your domain and whether SPF/DKIM passed for each. Read how to understand DMARC reports for a field-by-field walkthrough.

Use the reports to find any legitimate sending services that are not yet covered by SPF or DKIM, then fix their authentication before tightening the policy.

Step 6 — Escalate the policy

Once your reports show all legitimate mail passing consistently:

Move to p=quarantine — failing mail routes to spam instead of the inbox.
Watch for a week or two. If no legitimate mail fails, move to p=reject.
With p=reject in place, spoofed mail is refused at the SMTP level and never delivered.

See DMARC reject vs quarantine for a detailed comparison of both enforcement policies. Three-column comparison of the DMARC none, quarantine, and reject policies showing how each handles emails that fail authentication.

Three-column comparison of the DMARC none, quarantine, and reject policies showing how each handles emails that fail authentication.

The p= tag in your DMARC record sets which policy receivers apply to failing email. Six-step DMARC deployment path moving gradually from a monitoring-only none policy to a full reject policy.

Six-step DMARC deployment path moving gradually from a monitoring-only none policy to a full reject policy.

A conservative, report-driven rollout protects legitimate email delivery at each stage.

Common issues with DMARC records

Record not found after publishing

If the DMARC checker returns "no record found" right after you publish, DNS has not propagated yet — wait up to 30 minutes and check again. If it stays missing after an hour, confirm that the host field is set to _dmarc (not _dmarc.yourdomain.com when the provider auto-appends the domain), that the record type is TXT (not CNAME), and that you saved in the correct zone.

Syntax errors causing the record to be ignored

A single character mistake — a missing semicolon, a space inside mailto:, or v=dmarc1 with a lowercase 'd' — causes receivers to ignore the record entirely. Copy your record into the DMARC checker to catch syntax problems before they affect mail. The v tag must equal exactly DMARC1 (case-sensitive) and must be the first tag in the string.

Aggregate reports not arriving

Check that the rua mailbox exists and can receive external mail. Some organisations use a dedicated address like dmarc-reports@yourdomain.com — make sure it is not over quota and that your mail server accepts XML attachments. If reports still do not appear after 48 hours, verify the rua=mailto: URI is syntactically correct (no spaces, valid address). You can also check your email security score to confirm the record is being read by validators.

Subdomain policy confusion

If you have not set the sp= tag, subdomains inherit the main p= policy. A p=reject record without sp= will also apply reject to mail.subdomain.yourdomain.com — which can break mail sent from those subdomains if they are not yet fully authenticated. Set sp=none explicitly while you work through subdomain authentication, then tighten it once reports confirm those senders are clean. The article on DMARC subdomains and the sp tag covers this in detail.

Ready to enforce your DMARC policy?

Creating the record is the easy part — the work is reading reports and fixing every legitimate sender until the data supports enforcement. Check where your domain stands right now with the free Email Security Score, or use the DMARC generator to build a record tailored to your setup.

Questions readers ask

Frequently asked questions

fo=1 tells receivers to send a forensic (failure) report when any single authentication mechanism fails, even if DMARC still passes overall. It produces more granular data during the monitoring phase and is worth including in your starting record. Once you reach p=reject and your setup is stable, it is less critical — and note that many large providers have stopped sending ruf forensic reports regardless of the fo setting.

There is no fixed timeline. It depends on how many sending services use your domain and how quickly you can fix their authentication. Organisations with a simple email setup (one mail server, one or two sending services) can reach reject in two to four weeks. Complex environments with many third-party senders often take several months. Monitor your aggregate reports and move when the data tells you it is safe, not on a fixed calendar.

Turn DMARC findings into a managed fix path

Start in Palisade.

Get started

Share this article

Written by

Taylor Tabusa

Co-Founder & Head of Business Development, Palisade

Taylor Tabusa is the co-founder and Head of Business Development at Palisade, helping managed service providers turn email security into a practical, valuable service.