Defaults.Exposed › Tools › DMARC record decoder: read your policy tag by tag

DMARC record decoder: read your policy tag by tag

You have a DMARC (Domain-based Message Authentication, Reporting and Conformance) string and no clear sense of which parts of it are doing anything. Paste it below and each tag is read on its own: what it asks receivers to do, whether the value is one they recognise, and what changes if it is missing.

Of the 83,466,694 domains publishing a parseable DMARC record in the October 2026 census, 44,239 carry a p= value receivers do not recognise, and 27,170 of those have no p= token in the record at all. Those records ask receivers for nothing.

A record in that state is invisible to any check that only asks whether a record exists. It can satisfy a supplier questionnaire and show as present in a vendor dashboard while stopping no forged mail. The same census counts 39,763,622 domains at quarantine or reject, which is the population where the policy is doing work.

Every tag, with a permanent link

Eleven tags exist. Two of them decide whether the record does anything, and the rest tune it or ask for reports. Each entry below has its own anchor, so a link to one tag keeps pointing at that tag.

v= version, required

Marks the string as a DMARC record. It has to be the first tag and it has to read exactly v=DMARC1.

Accepts: DMARC1

Without it the string is not a DMARC record and every receiver ignores it, whatever else it says.

p= policy, required

What you ask receivers to do with mail that claims to be from your domain and fails the check.

Accepts: none, quarantine or reject

Without a valid p= the record is present and does nothing. It is the tag that decides whether the record has any effect at all.

sp= subdomain policy

The same instruction, applied to your subdomains instead of the domain itself.

Accepts: none, quarantine or reject

When it is absent, subdomains inherit p=. Setting sp=none under p=reject leaves every subdomain open, which is a common way to undo the record by accident.

rua= aggregate report address

Where receivers send the daily XML summary of what passed and what failed for your domain.

Accepts: one or more mailto: URIs, comma separated

Without it you get no reports, so you are moving policy blind. It changes nothing about delivery.

ruf= forensic report address

Where receivers send per-message failure reports.

Accepts: one or more mailto: URIs, comma separated

Most large receivers never send these, for privacy reasons. Absence costs you almost nothing.

adkim= DKIM alignment mode

How closely the DKIM (DomainKeys Identified Mail) signing domain has to match your From: domain.

Accepts: r for relaxed, s for strict

Defaults to r, which accepts a subdomain. Strict requires an exact match and breaks mail signed by a subdomain.

aspf= SPF alignment mode

How closely the envelope sender domain has to match your From: domain.

Accepts: r for relaxed, s for strict

Defaults to r. Strict breaks most third-party senders, which use their own bounce domain.

pct= percentage

The share of failing messages the policy applies to, so you can ramp a policy rather than switch it on for everything at once.

Accepts: an integer from 0 to 100

Defaults to 100. A value below 100 means most failing mail is still being delivered, which is worth knowing before you read a report.

fo= failure reporting options

Which failures trigger a forensic report.

Accepts: 0, 1, d, s, or several joined with colons

Defaults to 0, meaning report only when everything fails. Only matters when ruf= is set.

rf= report format

The format for forensic reports.

Accepts: afrf

Defaults to afrf and there is no second option in practice.

ri= report interval

How often you would like aggregate reports, in seconds.

Accepts: an integer, commonly 86400

Defaults to 86400, one day. Receivers treat it as a request and most send daily regardless.

The order the tags are read in

A receiver reads v= first and stops if it is not exactly DMARC1. It then looks for p=, and a record with no recognisable policy is treated as though nothing was published. Everything after that is applied on top: sp= for subdomains, the two alignment modes, and pct= to decide how much of the failing mail the policy applies to at all.

Tags a receiver does not know are ignored rather than treated as errors, which is why a typo in a tag name is quiet and a typo in a policy value is not.

Read next

What DMARC does, and what it cannot do · The typos that quietly switch a policy off · sp= and the subdomains it leaves open

Figures from the defaults.exposed census, data as of 12 October 2026. Census numbers move every month; the current values are on the census data page.