This guide provides real-world DMARC record examples for different deployment scenarios. Each example includes the complete DNS record, explanation of each tag, and guidance on when to use that configuration. Whether you're just starting with DMARC monitoring or implementing strict enforcement, these examples will help you choose the right approach for your domain.
Need help building your DMARC record?
Use our interactive DMARC generator tool to create a valid DMARC record step-by-step. The tool walks you through each tag and helps you choose the right values for your domain's security needs.
Start your DMARC journey with monitoring mode. These examples collect data about your email authentication without affecting email delivery, allowing you to understand your current email ecosystem before implementing enforcement.
Tip: DMARC aggregate reports are complex XML files that can be difficult to interpret manually. Using a DMARC monitoring tool like Suped makes it much easier to understand your authentication results and identify issues.
DNS record
v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com;What this does
When to use
Use this configuration when first implementing DMARC. Deploy for at least 1-2 weeks to gather data about your email ecosystem before moving to enforcement policies.
DNS record
v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com; ruf=mailto:dmarc-forensic@example.com; fo=1;What this does
When to use
Use when you need detailed troubleshooting information or are working with complex email infrastructures. Note that many providers don't send forensic reports due to privacy concerns.
Quarantine policies mark suspicious emails for special handling, typically moving them to spam folders. These examples show different approaches to implementing quarantine policies safely.
DNS record
v=DMARC1; p=quarantine; pct=10; rua=mailto:dmarc-reports@example.com;What this does
Implementation strategy
DNS record
v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@example.com;What this does
When to use
Use after successful gradual rollout when you're confident in your authentication setup but want to maintain email delivery rather than outright rejection.
Reject policies provide the strongest DMARC protection by instructing receiving servers to reject emails that fail authentication. Use these configurations only when you're confident in your email authentication setup.
DNS record
v=DMARC1; p=reject; rua=mailto:dmarc-reports@example.com;What this does
Prerequisites
DNS record
v=DMARC1; p=reject; rua=mailto:dmarc-reports@example.com; ruf=mailto:dmarc-forensic@example.com; fo=1;What this does
When to use
Use for mature DMARC implementations where you need both maximum security and detailed monitoring capabilities. Suitable for organizations with dedicated security teams.
These examples demonstrate advanced DMARC configurations for complex scenarios, including subdomain policies, strict alignment requirements, and specialized reporting configurations.
DNS record
v=DMARC1; p=reject; sp=quarantine; rua=mailto:dmarc-reports@example.com;What this does
Use cases
DNS record
v=DMARC1; p=reject; adkim=s; aspf=s; rua=mailto:dmarc-reports@example.com;What this does
Important considerations
Strict alignment can break legitimate email from third-party services that use different domains for DKIM signing or Return-Path. Test thoroughly before implementing in production.
Different industries and use cases may require specific DMARC configurations. These examples show common patterns for various organizational needs.
DNS record
v=DMARC1; p=reject; sp=reject; adkim=s; aspf=s; rua=mailto:dmarc-reports@bank.com; ruf=mailto:security@bank.com; fo=1;Configuration details
DNS record
v=DMARC1; p=quarantine; sp=none; rua=mailto:dmarc@store.com; pct=100;Configuration details
DNS record
v=DMARC1; p=quarantine; rua=mailto:admin@smallbiz.com;Configuration details
These examples show how to configure DMARC records for common troubleshooting scenarios and temporary configurations during problem resolution.
DNS record
v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com; ruf=mailto:dmarc-forensic@example.com; fo=1;When to use
What this provides
DNS record
v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com; ruf=mailto:dmarc-forensic@example.com; fo=0:1:d:s; ri=3600;What this does
Temporary use only
This configuration generates maximum reporting and should only be used temporarily during troubleshooting. The high volume of reports can be overwhelming for normal operations.
Follow this step-by-step roadmap to safely implement DMARC for your domain. Each phase builds on the previous one, ensuring a smooth transition to full email authentication.
Duration: 2-4 weeks
v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com;Goals
Duration: 4-6 weeks
v=DMARC1; p=quarantine; pct=10; rua=mailto:dmarc-reports@example.com;v=DMARC1; p=quarantine; pct=50; rua=mailto:dmarc-reports@example.com;v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@example.com;Goals
Duration: 2-4 weeks
v=DMARC1; p=reject; rua=mailto:dmarc-reports@example.com;Goals
What is the DMARC 'adkim' tag used for?
What DMARC tag specifies forensic reports?
Does the DMARC 'pct' tag affect aggregate reports?
What is the default value for the DMARC 'p' tag?
What DMARC alignment mode is stricter: 'relaxed' or 'strict'?
Does DMARC authenticate the 'From' header directly?
Which DMARC tag specifies the policy for subdomains?
What does the 'ruf' DMARC tag stand for?
