Back to Course
Լight modeDark mode

DMARC Tags

DMARC records are a combination of various mechanisms or DMARC tags that communicate specific instructions to email-receiving servers during mail transfer. Each of these DMARC tags contains a value that is defined by the domain owner. Today we are going to discuss what DMARC tags are and what each of them stands for.

Note: With the publication of RFC 9989 in 2026, the set of DMARC tags changed. Three tags (np, psd, and t) were added, and three tags (pct, rf, and ri) were moved to historic status. Records that still contain the historic tags continue to work, because receivers ignore tags they do not recognise, but they should be left out of new records. The tables below reflect the current RFC 9989 tag set, followed by the historic tags for reference.

Active DMARC tags (RFC 9989)

DMARC TagTypeDefault valueWhat it means
vmandatory The v tag represents the DMARC protocol version and always has the value v=DMARC1.
precommendednoneThis tag addresses the DMARC policy mode. You can select from reject, quarantine, and none. Under RFC 9989 it is technically optional and defaults to none if omitted, but it should always be set explicitly.
spoptionalThe policy mode configured for your main domain (p)The sp tag defines a policy mode for your existing subdomains.
npoptionalFalls back to sp, or to p if sp is absentThe np tag defines a policy mode for non-existent subdomains (names that do not resolve in DNS). It closes a spoofing gap that sp did not cover, since sp applies only to existing subdomains.
psdoptionalnThe psd tag indicates whether a domain is a Public Suffix Domain (a domain under which third parties register, such as .bank or .gov.uk). It supports the DNS Tree Walk used to find the organizational domain. Most ordinary domains do not need to set this.
toptionalnThe t tag is a test-mode flag. t=y tells receivers to treat the domain as still testing, so they apply policy more leniently; t=n means full enforcement. It replaces the gradual-rollout role the historic pct tag used to serve.
ruaoptional but recommended The rua tag specifies the address where reporting organizations send DMARC aggregate reports (governed by RFC 9990). Example: rua=mailto:[email protected];
rufoptional The ruf tag specifies the address where DMARC failure reports (formerly called forensic reports, now governed by RFC 9991) are sent. In practice most major receivers no longer send these, partly for privacy reasons. Example: ruf=mailto:[email protected];
fooptional0The fo tag sets the failure reporting options. It is ignored if ruf is not defined. The available options are: 0, a report is sent if the message fails both SPF and DKIM alignment; 1, a report is sent if the message fails either SPF or DKIM alignment; d, a DKIM failure report is sent if the DKIM signature fails validation regardless of alignment; s, an SPF failure report is sent if the message fails SPF evaluation regardless of alignment.
aspfoptionalrThe aspf tag sets the SPF alignment mode. The value can be strict (s) or relaxed (r).
adkimoptionalrThe adkim tag sets the DKIM alignment mode. The value can be strict (s) or relaxed (r).
 

Historic tags (defined in RFC 7489, removed by RFC 9989)

These tags still parse in existing records but should not be used in new ones.

DMARC TagFormer defaultWhat it meant
pct100Specified the percentage of mail to which the policy applied. Inconsistently implemented across receivers; its rollout role is now served by the t test-mode flag.
rfafrfSpecified the format for failure reports. Only afrf was ever supported.
ri86400Specified the requested interval in seconds between aggregate reports. Most receivers ignored it and used their own schedules.
 
DMARC Fundamentals >DMARC Tags
Course content
0%
Email Authentication Fundamentals

DMARC Tags