DMARC Settings

The DMARC Settings page lets you configure DMARC policy, reporting, and alignment for your domain.

Verification Status

A status indicator at the top of the page shows the current verification state of your domain's DMARC DNS delegation record, along with the date it was last checked. Click Verify to re-check the record immediately, or Setup Instructions to view the DNS records you need to publish.

Note: If your domain is only partially verified, saving your changes shows a warning that they will not take effect until the DMARC record is fully delegated and verified. A partially verified domain only processes DMARC aggregate reports.

Click View Raw DMARC Record to see the raw DMARC DNS record as currently configured, based on the policy and settings below.

Some fields are tagged New DMARCbis or Legacy:

Note: DMARCbis is the updated DMARC specification. Fields tagged New DMARCbis publish a tag that isn't part of the original DMARC standard and may not yet be honoured by every mailbox provider. Fields tagged Legacy publish a tag that DMARCbis is phasing out — it's still published for backwards compatibility, but you should prefer its DMARCbis replacement going forward.

Policy Settings

DMARC Policy

Publishes the p= tag — the policy applied to email from your domain that fails DMARC.

Policy	Description
None	Monitors email without taking action; reports are sent but no messages are blocked or filtered.
Quarantine	Suspicious emails are marked and delivered to spam or junk folders.
Reject	Emails that fail DMARC are completely blocked and not delivered.

Subdomain Policy

Publishes the sp= tag — the DMARC policy applied to email from subdomains of your domain. Set to Inherit to have subdomains use the same policy as the parent domain (no sp= tag is published); choose None, Quarantine, or Reject to override it.

Non-Existent Subdomain DMARC Policy

Publishes the np= tag — the policy applied to email claiming to be from a subdomain that doesn't exist in DNS. Set to Inherit to use the same policy as Subdomain Policy (no np= tag is published); choose None, Quarantine, or Reject to override it.

New DMARCbis: the np tag did not exist before DMARCbis. Some mail receivers may not yet support it.

Testing Mode

Publishes the t= tag, set to y (Testing Mode on) or n (off). While on, mailbox providers are asked to treat the policy as advisory only and not take action, even though it's published — useful for trialling a stricter policy before enforcing it.

New DMARCbis: the t tag did not exist before DMARCbis. Some mail receivers may not yet support it. DMARCbis recommends using Testing Mode instead of a reduced Percentage to trial a policy.

Percentage

Publishes the pct= tag — the percentage of emails to which recipient servers should apply the DMARC policy. All other emails have the next lower DMARC policy applied (e.g. if the published policy is Reject and the percentage is 30%, the remaining 70% have Quarantine applied).

Legacy: the pct tag is being phased out under DMARCbis in favour of Testing Mode, but it's still published where set for backwards compatibility.

Aggregate Reports

Report Interval

Publishes the ri= tag — how often recipient servers should send aggregate reports.

Legacy: the ri tag is being phased out under DMARCbis. Most providers report on a 24-hour cycle regardless of this setting.

Reports Will be Sent to

Publishes the rua= tag — the email addresses that should receive the raw DMARC aggregate reports.

Note: Aggregate reports are always also sent to DMARC Manager's unique reporting address so the platform can process them, in addition to any email addresses you add here.

Failure Reports

Controls whether the ruf= tag is published, and who receives failure reports.

Option	Description
Disabled	Failure report processing by DMARC Manager is disabled; no ruf= tag is published.
Enabled	Failure report processing is enabled; ruf= is published pointing to DMARC Manager.
Specific Recipients	ruf= is published pointing to specific recipients other than the DMARC Manager platform.

Note: Switching from Disabled to Enabled shows a confirmation dialog explaining that failure reports may contain personal information, such as email addresses or message content. If your organisation's legal policies prevent you from enabling this, choose Specific Recipients instead and process reports manually.

Note: Choosing Specific Recipients prevents DMARC Manager from capturing failure reports for this domain.

Report Options

Publishes the fo= tag — the conditions under which a failure report is generated.

Option	Description
SPF or DKIM fail and don't align	Generate a report when SPF or DKIM fails and doesn't align.
SPF and DKIM fail and don't align	Generate a report when both SPF and DKIM fail and don't align.
DKIM fails regardless of alignment	Generate a report when DKIM fails for any reason.
SPF fails regardless of alignment	Generate a report when SPF fails for any reason.

Alignment Settings

DKIM Alignment Mode

Publishes the adkim= tag — how strictly the DKIM domain must match your domain for DKIM to count as aligned.

Mode	Description
Relaxed	Allows subdomain matches (e.g. mail.example.com aligns with example.com)
Strict	Requires exact domain match

SPF Alignment Mode

Publishes the aspf= tag — how strictly the SPF domain must match your domain for SPF to count as aligned.

Mode	Description
Relaxed	Allows subdomain matches (e.g. mail.example.com aligns with example.com)
Strict	Requires exact domain match

Related Topics

• What is DMARC?: Introduction to DMARC and its purpose
• How Does DMARC Work?: Technical details about DMARC operation
• Why is DMARC Important?: Benefits and significance of DMARC
• Limitations of DMARC: Current constraints and challenges
• DMARC Syntax: Detailed information about DMARC DNS record fields
• DMARC Reports: Introduction to DMARC reporting, frequency and limitations