# How to create a DMARC record

> Create a DMARC record step by step: build the TXT record, pick a policy, publish it in DNS, and add reporting so you can safely enforce reject.

**To create a DMARC record, add a DNS TXT record named `_dmarc.yourdomain.com` with the value `v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com` — then confirm it exists with a [DMARC checker](/tools/dmarc) and start reading aggregate reports before you enforce a stricter policy.**

![How to create a DMARC record](/images/generated/how-to-create-dmarc-record.webp)

DMARC (Domain-based Message Authentication, Reporting, and Conformance) is an [email authentication](/resources-post/what-are-dmarc-dkim-and-spf) protocol that tells receiving mail servers what to do with messages that fail [SPF](/learning/what-is-spf) or [DKIM](/learning/what-is-dkim) checks. Without it, anyone can send email that appears to come from your domain.

## What goes into a DMARC record?

A DMARC record is a DNS TXT record published at the subdomain `_dmarc.yourdomain.com`. It contains tags separated by semicolons. Two tags are required; the rest are optional but important.

### Required tags

| Tag | Value | Purpose |
|---|---|---|
| `v` | `DMARC1` | Must appear first; identifies this as a DMARC record |
| `p` | `none` / `quarantine` / `reject` | Policy to apply when a message fails authentication |

### Commonly used optional tags

| Tag | Example | Purpose |
|---|---|---|
| `rua` | `rua=mailto:dmarc@example.com` | Where to send daily aggregate (XML) reports |
| `ruf` | `ruf=mailto:dmarc@example.com` | Where to send forensic failure reports (less commonly used) |
| `sp` | `sp=reject` | Override policy for subdomains; if omitted, subdomains inherit `p=` |
| `adkim` | `adkim=s` | DKIM alignment: `r` relaxed (default) or `s` strict |
| `aspf` | `aspf=s` | SPF alignment: `r` relaxed (default) or `s` strict |
| `fo` | `fo=1` | Failure reporting options; `fo=1` generates a report on any single auth failure |
| `pct` | `pct=25` | Percentage of failing mail the policy applies to — useful for staged rollout |

> **Note on `pct`:** RFC 9989 (published May 2026, the Standards Track update to RFC 7489) removed the `pct` tag from the specification. Major providers still honour it for now, but it is not guaranteed to behave consistently across all receivers. Prefer staged rollout through policy escalation (`none` → `quarantine` → `reject`) rather than relying on `pct`.

### How alignment modes work

`adkim` and `aspf` control how strictly the From domain must match the authenticated domain:

- **Relaxed (`r`, default):** The organizational domain must match. `mail.example.com` aligns with `example.com`.
- **Strict (`s`):** An exact match is required. `mail.example.com` does not align with `example.com`.

Start with relaxed alignment unless you have a specific reason for strict — it avoids breaking mail sent through subdomains of your domain.

## Step-by-step: how to create a DMARC record

### Step 1 — Confirm SPF and DKIM are in place

DMARC builds on top of SPF and DKIM. If neither is configured, DMARC has nothing to verify against and every message will fail. Check your current setup with the [SPF checker](/tools/spf) and [DKIM checker](/tools/dkim) before proceeding. If you need to set them up first, start with [what are DMARC, DKIM, and SPF](/resources-post/what-are-dmarc-dkim-and-spf).

### Step 2 — Build your starting record

For a first deployment, use `p=none` so you collect reports without affecting mail delivery. The minimum viable record is:

```
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com
```

Add `fo=1` to get failure reports on any authentication issue, not just complete DMARC failures:

```
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com; fo=1
```

Use the free [DMARC generator](/tools/dmarc-generator) to produce a record with the exact tags you need and copy the result.

### Step 3 — Publish the TXT record in DNS

Log in to your DNS provider (Cloudflare, GoDaddy, Google Domains, or your registrar's DNS panel) and add a new TXT record:

| Field | Value |
|---|---|
| **Type** | TXT |
| **Host / Name** | `_dmarc` (some providers need the full `_dmarc.yourdomain.com`) |
| **Value** | `v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com; fo=1` |
| **TTL** | 3600 (1 hour) is fine; lower for faster iteration during testing |

Save the record. DNS propagation typically completes within minutes to a few hours, though up to 48 hours is possible.

### Step 4 — Verify the record is live

Use the [DMARC checker](/tools/dmarc) or run a [DNS lookup](/tools/dns-lookup) for `_dmarc.yourdomain.com` TXT records. You should see your record returned verbatim.

![Two example DMARC TXT records showing a starting none policy and a final reject policy with strict alignment.](/images/figures/how-to-create-dmarc-record-fig3.webp)
*Top: a monitoring-only starting record. Bottom: a final enforcement record with strict alignment.*

### Step 5 — Read reports and fix authentication gaps

Aggregate reports arrive daily (usually as gzip-compressed XML) at the `rua` address. They show every IP that sent mail claiming to be from your domain and whether SPF/DKIM passed for each. Read [how to understand DMARC reports](/resources-post/how-to-understand-dmarc-reports) for a field-by-field walkthrough.

Use the reports to find any legitimate sending services that are not yet covered by SPF or DKIM, then fix their authentication before tightening the policy.

### Step 6 — Escalate the policy

Once your reports show all legitimate mail passing consistently:

1. Move to `p=quarantine` — failing mail routes to spam instead of the inbox.
2. Watch for a week or two. If no legitimate mail fails, move to `p=reject`.
3. With `p=reject` in place, spoofed mail is refused at the SMTP level and never delivered.

See [DMARC reject vs quarantine](/resources-post/dmarc-reject-vs-quarantine-whats-the-difference) for a detailed comparison of both enforcement policies.

![Three-column comparison of the DMARC none, quarantine, and reject policies showing how each handles emails that fail authentication.](/images/figures/how-to-create-dmarc-record-fig1.webp)
*The `p=` tag in your DMARC record sets which policy receivers apply to failing email.*

![Six-step DMARC deployment path moving gradually from a monitoring-only none policy to a full reject policy.](/images/figures/how-to-create-dmarc-record-fig2.webp)
*A conservative, report-driven rollout protects legitimate email delivery at each stage.*

## Common issues with DMARC records

### Record not found after publishing

If the [DMARC checker](/tools/dmarc) returns "no record found" right after you publish, DNS has not propagated yet — wait up to 30 minutes and check again. If it stays missing after an hour, confirm that the host field is set to `_dmarc` (not `_dmarc.yourdomain.com` when the provider auto-appends the domain), that the record type is TXT (not CNAME), and that you saved in the correct zone.

### Syntax errors causing the record to be ignored

A single character mistake — a missing semicolon, a space inside `mailto:`, or `v=dmarc1` with a lowercase 'd' — causes receivers to ignore the record entirely. Copy your record into the [DMARC checker](/tools/dmarc) to catch syntax problems before they affect mail. The `v` tag must equal exactly `DMARC1` (case-sensitive) and must be the first tag in the string.

### Aggregate reports not arriving

Check that the `rua` mailbox exists and can receive external mail. Some organisations use a dedicated address like `dmarc-reports@yourdomain.com` — make sure it is not over quota and that your mail server accepts XML attachments. If reports still do not appear after 48 hours, verify the `rua=mailto:` URI is syntactically correct (no spaces, valid address). You can also check your [email security score](/tools/email-security-score) to confirm the record is being read by validators.

### Subdomain policy confusion

If you have not set the `sp=` tag, subdomains inherit the main `p=` policy. A `p=reject` record without `sp=` will also apply reject to `mail.subdomain.yourdomain.com` — which can break mail sent from those subdomains if they are not yet fully authenticated. Set `sp=none` explicitly while you work through subdomain authentication, then tighten it once reports confirm those senders are clean. The article on [DMARC subdomains and the sp tag](/resources-post/dmarc-and-subdomains-aspf-adkim-and-sp-tags-explained) covers this in detail.

## Frequently asked questions

### Do I need SPF and DKIM before creating a DMARC record?

You need at least one of them. DMARC passes when either SPF or DKIM passes with proper domain alignment. In practice, you should have both configured before publishing DMARC: SPF covers mail servers you authorise, and DKIM provides a cryptographic signature that survives email forwarding where SPF often breaks.

### What is the correct hostname for a DMARC record?

The record must be published at `_dmarc.yourdomain.com`. If your domain is `acmecorp.com`, the hostname is `_dmarc.acmecorp.com`. Most DNS providers let you enter just `_dmarc` in the host field and automatically append the domain — check your provider's documentation to avoid publishing a duplicate suffix like `_dmarc.acmecorp.com.acmecorp.com`.

### Can a domain have more than one DMARC record?

No. RFC 7489 (and its successor RFC 9989) specify that a domain must have exactly one DMARC record. If your DNS query returns two TXT records at `_dmarc.yourdomain.com`, receivers will treat the domain as having no valid DMARC policy and ignore both. Remove duplicates immediately if found.

### What does `fo=1` do, and should I include it?

`fo=1` tells receivers to send a forensic (failure) report when any single authentication mechanism fails, even if DMARC still passes overall. It produces more granular data during the monitoring phase and is worth including in your starting record. Once you reach `p=reject` and your setup is stable, it is less critical — and note that many large providers have stopped sending `ruf` forensic reports regardless of the `fo` setting.

### How long does it take to go from none to reject?

There is no fixed timeline. It depends on how many sending services use your domain and how quickly you can fix their authentication. Organisations with a simple email setup (one mail server, one or two sending services) can reach reject in two to four weeks. Complex environments with many third-party senders often take several months. Monitor your aggregate reports and move when the data tells you it is safe, not on a fixed calendar.

## Ready to enforce your DMARC policy?

Creating the record is the easy part — the work is reading reports and fixing every legitimate sender until the data supports enforcement. Check where your domain stands right now with the free [Email Security Score](/tools/email-security-score), or use the [DMARC generator](/tools/dmarc-generator) to build a record tailored to your setup.