Definition
DMARC sampling is the use of the pct= tag in a DMARC record to apply the published enforcement policy to only a percentage of messages that fail authentication, rather than to all of them. Sampling lets a domain owner roll out quarantine or reject policies gradually, observing the real-world effect on legitimate mail before enforcing the policy across the entire stream.
How It Works
The pct= tag accepts a value from 0 to 100, representing the percentage of failing messages to which the policy applies. The default, when the tag is omitted, is 100 percent. When a receiving server evaluates a message that fails DMARC alignment, it applies the policy to only the specified fraction of failures and lets the remainder through as if the policy were p=none.
For example, a record of v=DMARC1; p=reject; pct=25; rua=mailto:dmarc@example.com tells receivers to reject only 25 percent of failing messages while monitoring the rest. The sampled population is intended to be pseudorandom, though in practice the exact selection method is left to each receiving server.
Why Sampling Matters
Sampling is valuable because DMARC enforcement can have serious unintended consequences. If a domain switches straight to p=reject, any legitimate message that fails alignment — a misconfigured marketing tool, a forwarded newsletter, or a vendor's invoice system — is immediately rejected. Sampling limits the blast radius while the domain owner watches aggregate reports to find and fix those failures.
Best practice when using sampling:
- Start with
p=none; pct=100to gather a baseline of authentication failures. - Fix every legitimate source, then move to a low percentage such as
p=quarantine; pct=10. - Increase the percentage in steps as reports confirm no legitimate mail is being affected.
- Reach
pct=100only after several clean reporting cycles.
A partial pct= value is almost always a temporary state, not a permanent configuration. Leaving it low indefinitely weakens protection against email spoofing.
Example
A university sets p=quarantine; pct=10 for its university.edu domain. Over two weeks, aggregate reports show only a single legacy department sending failing mail. The team fixes that department's SPF record, then raises the record to pct=50 and finally pct=100, completing the rollout without disrupting staff email.
Was this useful?
Related Glossary Terms
Abuse Complaint
An abuse complaint is a report from a recipient who marks an email as spam, which negatively affects sender reputation and deliverability.
Alt Text
Alt text is the written alternative to an image in an email, displayed when images are blocked, slow to load, or consumed by screen readers.
AOL Mail for Email Marketers
AOL Mail is a legacy email provider with specific deliverability requirements and rendering quirks, now operating as part of the Yahoo+AOL network under shared infrastructure.
Email Authentication Protocols
Email authentication protocols are technical standards that verify the identity of an email sender, helping mailbox providers distinguish legitimate mail from spam and phishing.
BIMI
BIMI (Brand Indicators for Message Identification) is an email standard that allows brands to display their logo next to their emails in supported email clients. It requires DMARC enforcement at quarantine or reject policy.
Bounce Management
Bounce management is the process of handling emails that are rejected by mailbox providers, including classification, removal of bad addresses and protection of sender reputation.
Frequently Asked Questions
No. The `pct=` tag only affects messages that fail DMARC authentication. Messages that pass SPF or DKIM alignment are delivered normally regardless of the sampling percentage.
Most major providers honour the `pct=` tag, but support is not universal and the selection of which messages fall within the percentage is not precisely standardised. Treat sampling as a rollout aid rather than an exact enforcement guarantee.
If the `pct=` tag is omitted, the DMARC policy applies to 100 percent of failing messages by default. This is the behaviour most domains want once enforcement is complete.
Sampling applies to the enforcement policy, not to reporting. Aggregate and forensic reports continue to be generated based on the `rua=` and `ruf=` tags regardless of the `pct=` value.