Definition
DMARC policy tags are the key-value pairs published in a DMARC DNS TXT record that instruct receiving mail servers how to handle messages that fail authentication. The record always begins with the v tag (version), which must be DMARC1. The p tag specifies the policy for the organisational domain: none (monitor only), quarantine (send to spam), or reject (block outright). The sp tag allows a separate subdomain policy — if omitted, subdomains inherit the p value.
Reporting tags include rua (aggregate report URI), which defines where receivers send daily XML summary reports, and ruf (forensic report URI), which receives individual failure reports when the fo tag requests them. The pct tag controls the percentage of non-compliant messages that receive the policy action, enabling gradual rollout from 1 to 100 per cent. Alignment tags adkim and aspf set DKIM and SPF alignment to strict (s) or relaxed (r). The fo tag (failure reporting options), rf (report format), and ri (report interval) complete the set of configurable options.
Best Practices
Begin DMARC deployment with p=none to collect authentication data without affecting delivery. Analyse aggregate reports for at least two to four weeks to identify all legitimate sending sources before tightening the policy.
Set p=quarantine before moving to p=reject. This intermediate step allows you to observe how mailbox providers handle borderline authentication cases without permanently losing email. Monitor your delivery rates and review spam folder placements during this phase.
Use the sp tag to publish a separate policy for subdomains. This is essential when different teams or departments manage different subdomains. Set sp=reject on subdomains that should not be sending email at all, which prevents unauthorised use.
Set pct to a low value such as 5 or 10 when first enforcing a quarantine or reject policy. Monitor the impact on your delivery metrics before increasing to 100 per cent. This gradual approach reduces the risk of blocking legitimate email due to misconfiguration.
Configure rua with a dedicated email address that can handle large volumes of aggregate XML reports. Consider using a DMARC report analysis service to process and visualise the data. Avoid using ruf unless you have the infrastructure to process potentially high volumes of forensic reports.
Related Glossary Terms
DMARC Alignment
DMARC identifier alignment determines whether the domain in the From header matches the domains used in SPF and DKIM authentication. Strict or relaxed.
Email BIMI VMC
BIMI Verified Mark Certificate (VMC) certifies brand logo ownership for display in supporting email clients. VMCs cost £1,500-2,000+ per year per logo and require DMARC reject or quarantine policy plus SVG logo format.
Email Bulk
Bulk email classification distinguishes mass commercial messages from transactional emails, with specific authentication requirements for senders over 5,000 daily.
Email DKIM Selector
DKIM selector management involves rotating signing keys across named selectors (default, s1, s2, 2024). Multi-selector strategies allow zero-downtime key rotation every 6-12 months for ongoing email authentication.
Email DMARC Failure
DMARC failure handling processes what happens when SPF and DKIM both fail authentication: p=none monitors, p=quarantine sends to spam, p=reject bounces. Gradual policy escalation with testing prevents false positives.
DMARC Policy Graduation
DMARC policy graduation process from p=none through p=quarantine to p=reject, including subdomain staging, false positive handling, and typical timelines.
Frequently Asked Questions
`p=none` instructs receiving mail servers to take no action against messages that fail DMARC authentication. The messages are delivered normally, but the receiver sends aggregate reports back to the domain owner. This policy is used exclusively for monitoring and discovery before enforcement.
The `pct` tag specifies the percentage of non-compliant messages to which the DMARC policy should apply. A value of `pct=25` means only 25 per cent of failing messages receive the quarantine or reject action; the remaining 75 per cent are delivered normally. This allows controlled rollout of enforcement.
`rua` receives aggregate reports containing summary data about all messages from a domain over a reporting period. These reports are large XML files sent daily. `ruf` receives forensic reports containing copies of individual messages that failed DMARC. Forensic reports are sent per-message and can be extremely high volume, so `ruf` is rarely used.
The `fo` tag (failure reporting options) controls when forensic reports are sent to the `ruf` address. Options include `fo=0` (generate report if both SPF and DKIM fail), `fo=1` (generate report if either SPF or DKIM fails), `fo=d` (generate report if DKIM fails), and `fo=s` (generate report if SPF fails).
Neither tag is required; both default to relaxed (`r`) if omitted. You only need to set them if you want strict alignment. Most organisations begin with relaxed alignment and only introduce strict alignment after confirming all legitimate email sources are properly authenticated.