DMARC record tags explained: policy, reports, alignment and test mode

Three tags set the policy for mail that fails DMARC:

• p covers the domain itself. none only asks for reports, quarantine asks receivers to treat failing mail as suspicious (usually the spam folder), and reject asks them to turn it away. A record without p counts as p=none.
• sp covers subdomains that exist, like news.example.com. Without it, they get the p policy. It only works on the main domain's record, and receivers ignore it on a subdomain's own record.
• np covers subdomains that don't exist at all, the made up names forged mail likes to use. Without it, they get sp, or p when sp is missing too.

adkim and aspf set alignment: how closely the domain that passed DKIM or SPF has to match the From address. The default, r for relaxed, accepts any name under the same main domain, so mail.example.com lines up with example.com. s for strict needs an exact match.

rua lists where receivers should send aggregate reports, as mailto: addresses split by commas. Without it, receivers send none. ruf asks for failure reports about single messages, and fo picks which failures trigger them: 0 (the default) when every check fails, 1 when any check fails, d for a DKIM failure and s for an SPF failure. A report address on another domain only works if that domain agrees, with a record at a name like example.com._report._dmarc.reports.example.net.

RFC 9989 replaced the original DMARC spec, RFC 7489, in May 2026 and cleaned up the tags. pct used to apply the policy to only part of the failing mail, but receivers rarely got values other than 0 and 100 right. Its job went to t. With t=y, a receiver applies the policy one step softer, so reject acts like quarantine and quarantine acts like none. It does nothing for p=none and doesn't change the reports. rf and ri, the report format and interval, are retired too, and receivers that follow RFC 9989 ignore all three.

psd is for registries that run public suffixes like .com or .co.uk, so leave it out on a normal domain. It matters because receivers now find the policy for a subdomain by walking up its name in DNS, instead of checking a public list of suffixes.

Keep one DMARC record per name. A receiver that finds two throws both out and looks for a record higher up.

The DNS Lookup shows a domain's DMARC record, explains each tag in a dropdown, fills in the defaults it leaves out, and flags retired tags.