DMARC Record — DMARC Record (Domain-based Message Authentication TXT)
Instructs receiving mail servers what action to take (none, quarantine, or reject) if an email fails both SPF and DKIM checks.
DMARC
RFC 7489
3600 seconds (1 hour)
Email & Authentication
BIND Zone File Syntax Example
_dmarc.example.com. 3600 IN TXT "v=DMARC1; p=reject; rua=mailto:dmarc-reports@example.com; pct=100"How to Query & Check DMARC Records
dig +short TXT _dmarc.example.comnslookup -type=TXT _dmarc.example.comResolve-DnsName -Name _dmarc.example.com -Type TXTRecommended Best Practices
Begin with `p=none` for 2–4 weeks to monitor reports without impacting email deliverability. Once all legitimate senders align with SPF/DKIM, upgrade to `p=quarantine` and finally `p=reject`.
- •Preventing attackers from impersonating your executive staff or brand via email spoofing
- •Unlocking BIMI brand logos in Gmail and Apple Mail inbox interfaces
- •Receiving daily XML delivery reports to detect unauthorized outbound servers
Common Configuration Mistake
Jumping straight to `p=reject` without checking third-party CRM or marketing tools, causing critical business emails to bounce.
DNS DMARC Record Questions & Answers
Common questions regarding DNS propagation, TTL settings, and zone file syntax.
DMARC unites SPF and DKIM by establishing an enforcement policy (`p=none`, `p=quarantine`, `p=reject`) and providing automated aggregate reporting (`rua=mailto:...`) so domain owners can audit legitimate versus spoofed email traffic.