DMARC (Domain-based Message Authentication, Reporting & Conformance) builds on SPF and DKIM to tell receiving mail servers what to do when authentication fails. It also provides a reporting mechanism so domain owners can see who is sending email on their behalf.
The DMARC record
Suped supports record tags from the updated DMARC specification (RFC 9989), including np, psd, and t. Receiving mail server support may vary. The record version remains v=DMARC1.
A DMARC record is a DNS TXT record published at _dmarc.yourdomain.com.
Example:
v=DMARC1; p=reject; rua=mailto:dmarc@suped.com; adkim=r; aspf=r; fo=1;Tags
| Tag | Purpose | Values |
|---|---|---|
v | Version (required) | DMARC1 |
p | Policy (recommended; include explicitly for interoperability) | none (monitor only), quarantine (send to spam), reject (block) |
rua | Aggregate report recipients | Comma-separated mailto: addresses |
ruf | Failure report recipients | Comma-separated mailto: addresses |
adkim | DKIM alignment mode | r (relaxed, default) or s (strict) |
aspf | SPF alignment mode | r (relaxed, default) or s (strict) |
sp | Existing subdomain policy | none, quarantine, or reject (overrides p for existing subdomains of the organizational domain) |
np | Non-existent subdomain policy | none, quarantine, or reject. Inherits sp, then p, when omitted. |
psd | Public suffix and organizational-domain discovery | y (public suffix domain), n (not a public suffix; identifies an organizational domain), u (default; leaves organizational-domain discovery to the receiver) |
t | DMARC policy testing mode | y (request testing mode) or n (normal enforcement, default) |
fo | Failure reporting options | 0 (neither SPF nor DKIM produces an aligned pass), 1 (either fails to produce an aligned pass), d (DKIM fails), s (SPF fails) |
Under the updated DMARC specification (RFC 9989), an otherwise valid record without p is treated as p=none. Keep p explicit in records you publish for interoperability with existing tools and receivers. Non-existent subdomains for np are those returning NXDOMAIN in DNS, not just those without a DMARC record. Only public suffix operators should publish psd=y.
Deprecated tags
The updated DMARC specification (RFC 9989) removes pct (policy sampling percentage), ri (requested aggregate reporting interval), and rf (failure report format). Receivers following it ignore these tags. Suped can recognize them in legacy records, but they should be omitted from new records. Do not rely on pct to limit enforcement or ri to control report timing.
Alignment
DMARC requires that the domain checked by SPF or DKIM matches the From header domain.
- Relaxed - Organizational domain match.
mail.example.comaligns withexample.com. - Strict - Exact domain match only.
mail.example.comdoes not align withexample.com.
Recommended rollout path
p=none- Monitor traffic without affecting delivery. Review DMARC reports to identify all legitimate sending sources.p=quarantine- Once legitimate sources produce an aligned SPF or DKIM pass, request that receivers quarantine messages that fail DMARC. Continue reviewing reports.p=reject- Once remaining legitimate-source issues are resolved, request that receivers reject messages that fail DMARC. Receivers make the final delivery decision.
t=y requests testing mode for the applicable p, sp, or np policy: reject becomes quarantine, and quarantine becomes none. A none policy and report generation are unchanged. Omitted or t=n requests normal enforcement. This is not percentage sampling: older receivers may ignore t and apply the published policy, so it is not a guarantee against delivery failures.
DMARC reports
ISPs send daily aggregate reports (XML) to the addresses in your rua tag. These reports show which IPs sent email using your domain and whether authentication passed or failed. Suped processes these reports automatically and presents them in a readable format.
