StopBouncingDMARC Policy Levels Explained
The three DMARC policy values control what happens to email that fails DMARC authentication. Start with none and work toward reject.
p=noneMonitor onlyEmail that fails DMARC is delivered normally. Nothing is blocked or quarantined. Use this as the first step: add a rua= address to receive reports and identify all your legitimate sending sources before enforcing anything.
p=quarantineQuarantine failuresEmail that fails DMARC is sent to the recipient's spam or junk folder. Use after reviewing reports and confirming all legitimate sources pass SPF or DKIM. Use pct=10 to start with partial enforcement.
p=rejectReject failuresEmail that fails DMARC is rejected by the receiving server. Maximum protection against domain spoofing and phishing. The recommended long-term goal — but only after confirming all legitimate sources pass authentication.
DMARC Tag Reference
A full DMARC record can include up to 11 tags. Only v= and p= are required.
| Tag | Description |
|---|---|
| v=DMARC1 | Version identifier. Must be the first tag in every DMARC record. |
| p= | Policy for the From domain. Values: none (monitor only), quarantine (send to spam), reject (block delivery). Start with none and work toward reject. |
| rua= | Email address to receive aggregate (summary) DMARC reports. Reports arrive as XML files, typically once per day per sender. Format: rua=mailto:reports@yourdomain.com |
| ruf= | Email address to receive forensic (failure) DMARC reports — full copies of individual failing messages. Not all senders send ruf reports due to privacy concerns. |
| sp= | Policy for subdomains (e.g. mail.yourdomain.com). If not set, subdomains inherit the main p= policy. Useful for applying a different policy to subdomains. |
| adkim= | DKIM alignment mode. r = relaxed (default) — allows subdomain alignment. s = strict — From domain must exactly match the d= tag in the DKIM signature. |
| aspf= | SPF alignment mode. r = relaxed (default) — allows subdomain alignment. s = strict — From domain must exactly match the SPF-authenticated domain. |
| pct= | Percentage of failing email to apply the policy to. Default is 100. Use pct=10 when rolling out quarantine or reject to gradually increase enforcement without risking legitimate mail. |
| fo= | Forensic reporting options. 0 = report when both SPF and DKIM fail (default). 1 = report when either fails. d = DKIM failure only. s = SPF failure only. |
| rf= | Report format. afrf is the only widely supported format. Usually omitted (defaults to afrf). |
| ri= | Requested interval between aggregate reports in seconds. Default is 86400 (24 hours). Most senders ignore this and send daily regardless. |
DMARC Rollout Guide
Moving straight to p=rejectcan block legitimate email if you haven't identified all sending sources. This six-step process ensures a safe rollout.
Start with p=none and a reporting address
Publish: _dmarc.yourdomain.com TXT "v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com" This does not affect email delivery. It tells receiving servers to send daily aggregate reports to your address. You need these reports to understand who is sending email as your domain.
Review aggregate reports for 2–4 weeks
DMARC reports are XML files that list every sending source that used your domain, how many messages each sent, and how many passed or failed SPF and DKIM. Review them to find: legitimate services not yet in your SPF record, services using DKIM without your knowledge, and unauthorised senders (phishing or spam).
Fix authentication gaps
Add any legitimate sending source that isn't passing authentication to your SPF record or ensure DKIM is configured. Use the SPF checker and DKIM checker above to verify each source. Every legitimate sender should pass either SPF or DKIM (preferably both).
Move to p=quarantine with pct=10
Update: "v=DMARC1; p=quarantine; pct=10; rua=mailto:dmarc@yourdomain.com" This applies the quarantine policy to 10% of failing messages — a safe way to start enforcing without risking legitimate mail. Watch reports for unexpected failures for 1–2 weeks.
Increase pct to 100
Update pct=10 to pct=100: "v=DMARC1; p=quarantine; pct=100; rua=mailto:dmarc@yourdomain.com" If no legitimate mail is failing, this applies quarantine to all failing messages. Continue monitoring reports.
Move to p=reject
Final step: "v=DMARC1; p=reject; rua=mailto:dmarc@yourdomain.com" This fully blocks email that fails DMARC authentication. Provides maximum protection against spoofing and phishing attacks using your domain. Gmail and Yahoo recommend reject for all senders who can achieve it.
DMARC FAQ
What is DMARC?
DMARC (Domain-based Message Authentication, Reporting & Conformance) is a DNS policy record that ties together SPF and DKIM authentication. It tells receiving mail servers what to do with email that fails authentication checks — ignore it (none), move it to spam (quarantine), or reject it outright (reject). It also enables reporting so you can see who is sending email as your domain.
What DMARC policy should I use?
Start with p=none and a rua= reporting address. Review reports for 2–4 weeks to identify all legitimate sending sources. Once all legitimate sources pass SPF or DKIM, move to p=quarantine (start with pct=10), then to p=reject for maximum protection. Skipping straight to reject is risky — you may block legitimate email before you have identified all sending sources.
Is DMARC required?
As of 2024, Google and Yahoo require all bulk senders (5,000+ emails per day) to have DMARC configured with at least p=none. For most businesses, p=reject is the recommended long-term goal as it provides the strongest protection against domain spoofing and phishing attacks using your brand.
What is pct in a DMARC record?
The pct tag specifies the percentage of failing email to which the policy applies (default is 100%). During rollout, use pct=10 to apply your quarantine or reject policy to only 10% of failing messages, gradually increasing to 100 as you gain confidence. Once at pct=100 with no unexpected failures, you can remove the pct tag.
What is a DMARC aggregate report (rua)?
DMARC aggregate reports are daily XML summaries sent by receiving servers to your rua= email address. They list every IP address that sent email using your domain, the volume from each, and whether each message passed or failed SPF and DKIM authentication. These reports are essential for identifying unauthorized senders and authentication gaps.
How does DMARC alignment work?
DMARC alignment requires that the domain in the visible From: header matches the domain that passed SPF or DKIM. Without alignment, a spammer could pass SPF using their own authorized server while spoofing your brand's From address. Alignment is what makes DMARC enforce your policy on the address users actually see, not just the technical envelope.