Where do I add the DMARC TXT record?

At the name _dmarc under your domain, for example _dmarc.example.com, as a TXT record. In most DNS panels you type only _dmarc in the name or host field, because the panel adds the domain for you.

What is the simplest valid DMARC record?

v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com. It applies no policy, but it starts the aggregate reports, which you need before moving to quarantine or reject.

Can I still use pct in a DMARC record?

RFC 9989, published in May 2026, replaces RFC 7489 and removes pct, rf and ri. Leaving them in does not break the record, and some receivers still read pct, but you cannot count on it. RFC 9989 adds t=y (testing mode) as the replacement for gradual rollouts.

DMARC Record Examples: 10 TXT Records to Copy

Introduction

A DMARC record is a single line of text, but a wrong tag, a missing mailto: or a record on the wrong name means receivers ignore it completely. The fastest way to get it right is to start from a known-good example.

This page collects DMARC record examples for the situations you are most likely to have, explains every tag they use, and shows how to do a DMARC lookup to check what you publish. Tags follow RFC 9989 (May 2026), which replaces RFC 7489.

If you are new to DMARC, What Is DMARC? A Simple Guide covers the concepts first.

Where the DMARC TXT Record Goes

A DMARC record is a TXT record published at _dmarc under your domain:

_dmarc.example.com.  3600  IN  TXT  "v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com"

In a DNS panel this usually means:

Field	Value
Type	TXT
Name / Host	`_dmarc`
Value	`v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com`
TTL	Default (1 hour is fine)

Most panels append your domain to the name. Typing _dmarc.example.com can create _dmarc.example.com.example.com, which no receiver will ever find. Step-by-step instructions for specific DNS hosts are in the DNS provider guides.

DMARC Tags Explained

Tag	Example	Meaning	Default
`v`	`v=DMARC1`	Version. Must be first	Required
`p`	`p=none`	Policy for the domain: `none`, `quarantine` or `reject`	Always set it
`sp`	`sp=quarantine`	Policy for subdomains	Same as `p`
`np`	`np=reject`	Policy for subdomains that do not exist in DNS	Same as `sp`
`rua`	`rua=mailto:dmarc@example.com`	Where to send aggregate reports	No reports
`ruf`	`ruf=mailto:dmarc@example.com`	Where to send failure reports	No reports
`adkim`	`adkim=s`	DKIM alignment: `r` relaxed, `s` strict	`r`
`aspf`	`aspf=s`	SPF alignment: `r` relaxed, `s` strict	`r`
`fo`	`fo=1`	When to send failure reports	`0`
`t`	`t=y`	Testing mode: apply one policy level lower	`n`
`psd`	`psd=n`	Public suffix domain flag; only for registry operators	Leave out

Tags after v can come in any order, separated by semicolons. RFC 9989 removed pct, rf and ri. Receivers that implement it ignore them.

The policies themselves, and what each one does to failing mail, are explained in DMARC Policy Explained.

DMARC Record Examples

Replace example.com and the report addresses with your own.

1. Monitoring only (where everyone should start)

v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com

No mail is blocked. Receivers send daily aggregate reports, so you can find every service that sends as your domain before you enforce anything.

2. Monitoring with reports to an external service

v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com,mailto:reports@reports.example.net

Multiple addresses are separated by commas. When the report address is on another domain, that domain must authorise it, or receivers will not send there:

example.com._report._dmarc.reports.example.net.  TXT  "v=DMARC1"

DMARC reporting services publish this record for you; you only need it if you run the receiving mailbox yourself.

3. Quarantine

v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@example.com

Mail that fails DMARC goes to spam or junk. Move here once the reports show your legitimate senders passing.

4. Reject

v=DMARC1; p=reject; rua=mailto:dmarc-reports@example.com

Mail that fails DMARC is refused. This is the setting that stops attackers from spoofing your domain.

5. Reject, including non-existent subdomains

v=DMARC1; p=reject; np=reject; rua=mailto:dmarc-reports@example.com

np covers names like invoices.example.com that do not exist in your DNS, which an attacker might invent. Receivers that do not know np ignore it.

6. Testing mode before reject

v=DMARC1; p=reject; t=y; rua=mailto:dmarc-reports@example.com

Receivers that implement RFC 9989 apply one level lower: p=reject; t=y is handled as quarantine. Receivers that do not know t apply reject directly, so publish this only when you would accept p=reject anyway.

7. Stricter policy for the main domain than for subdomains

v=DMARC1; p=reject; sp=quarantine; rua=mailto:dmarc-reports@example.com

Useful while a subdomain used by a marketing platform is still being fixed. A subdomain can also publish its own record, which takes precedence:

_dmarc.news.example.com.  TXT  "v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com"

8. Strict alignment

v=DMARC1; p=reject; adkim=s; aspf=s; rua=mailto:dmarc-reports@example.com

With strict alignment, mail.example.com no longer aligns with example.com: the domains must match exactly. Most domains do not need it, and it breaks services that sign or bounce with a subdomain. Use relaxed unless you have a specific reason.

9. With failure reports

v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@example.com; ruf=mailto:dmarc-failures@example.com; fo=1

fo=1 asks for a failure report when either SPF or DKIM fails, not only when both do. Many large receivers do not send failure reports for privacy reasons, so do not rely on them; the aggregate reports are what matter.

10. A domain that never sends email

v=DMARC1; p=reject;

Pair it with v=spf1 -all on the domain. Any mail claiming to come from it is forged and should be refused. Add a rua address if you want to see who is trying.

How to Do a DMARC Lookup

Query the _dmarc name directly:

dig +short TXT _dmarc.example.com

On Windows:

nslookup -type=TXT _dmarc.example.com

You should get back exactly one string starting with v=DMARC1. If nothing comes back, the record is missing or on the wrong name; DMARC Record Not Found goes through the causes.

The DMARC Checker does the lookup and validates every tag, so you also catch errors that dig does not flag.

Common DMARC Record Mistakes

Mistake	Example	Fix
Version not first	`p=none; v=DMARC1`	Start with `v=DMARC1`
Missing `mailto:`	`rua=dmarc@example.com`	`rua=mailto:dmarc@example.com`
Commas instead of semicolons between tags	`v=DMARC1, p=none`	Tags are separated by `;`
Two DMARC records	Two TXT records at `_dmarc`	Keep one; with two, receivers apply no policy
Record on the domain itself	TXT on `example.com`	It must be on `_dmarc.example.com`
`p=reject` with no reports	`v=DMARC1; p=reject` on an active domain	Add `rua` and confirm your senders first
Copied smart quotes	`“v=DMARC1; ...”`	Plain text
Old tags	`pct=50; ri=3600`	Remove; use `t=y` for testing

Choosing the Right Example

Just starting: example 1, and read the reports for a few weeks
All legitimate senders pass: example 3, then example 5
Unsure about the last step: example 6 for a short period
Parked or website-only domain: example 10, today

The step-by-step plan from p=none to p=reject explains what the reports should show before each move.

Next Steps

Check your current record: DMARC Checker →
Build a record without typing tags by hand: DMARC Generator →
Check SPF, DKIM and DMARC together: Domain Score →
Read the reports your record asks for: Start free → — DMARC Examiner receives your aggregate reports and shows pass rates per sending source, so you know when it is safe to move to quarantine or reject.

Related Articles:

DMARC Record Examples: 10 Ready-to-Use TXT Records