DMARC TXT Record: Exact Host, Value, and Validation Steps

The most common DMARC publishing error is using the right value at the wrong DNS name. DMARC is discovered at _dmarc plus the domain in the visible From header.

For a visible sender such as news@example.com:

DNS name: _dmarc.example.com
Record type: TXT

In a DNS editor that appends the zone automatically, enter _dmarc. In a fully qualified-name field, enter _dmarc.example.com.

A safe starter record

v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com

This asks receivers to deliver normally while sending aggregate reports to the specified address. It is a monitoring state, not an enforcement state.

After you know the sender inventory, the policy value can move to quarantine or reject:

v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@example.com
 
v=DMARC1; p=reject; rua=mailto:dmarc-reports@example.com

Use one value, not both. The blank line only separates examples.

Field-by-field explanation

Keep the record readable. Some DNS editors add quotes automatically; do not add nested quotes unless the editor’s format requires them.

The alignment check

DMARC does not simply ask whether SPF or DKIM passed. It asks whether an authenticated domain aligns with the visible From domain.

Send a test message and inspect Authentication-Results. A DNS lookup cannot tell you whether the actual provider used the domain you intended.

Validate the exact record

dig +short TXT _dmarc.example.com

If the result is empty:

1. confirm the DNS zone is authoritative for the domain;
2. check whether the UI appended the domain twice;
3. wait for the TTL and resolver caches;
4. query the authoritative nameserver if public resolvers disagree.

If multiple DMARC TXT records are returned, merge them into one. Receivers should not have to choose between competing policies.

Reporting addresses

Aggregate DMARC reports can identify services sending for your domain. Use a reporting address that is monitored and authorized to receive the data. If the address is at another domain, your reporting provider may require an additional DNS authorization step; follow its instructions.

Do not publish a mailbox you do not control. A record can be syntactically valid and operationally useless if no one reviews the reports.

A note about staged enforcement

Google’s DMARC rollout guidance shows pct-based examples for gradually applying quarantine or reject. RFC 9989, published in May 2026, removes pct from the updated DMARC specification because partial enforcement was implemented inconsistently.

For a current rollout, use p=none while inventorying senders, then use your reporting or sending provider’s supported staged-enforcement mechanism before moving to full quarantine or reject. Do not assume that a pct value has the same effect at every receiver.

Common DNS mistakes

• Putting DMARC at the root domain instead of the _dmarc host.
• Publishing two DMARC records.
• Omitting the semicolon between tags.
• Using uppercase or lowercase inconsistently is not the main issue; the host, syntax, and values are.
• Copying a report address without configuring the receiving service.
• Enforcing a policy before testing every legitimate stream.

FAQ

Does the DMARC record go on the sending subdomain?

Use the domain shown in the visible From header and then apply the provider’s organizational-domain rules for subdomains. If you send from news.example.com, decide whether a dedicated subdomain policy is needed rather than guessing from the envelope-from domain.

Does p=none mean DMARC is disabled?

It means receivers should not enforce quarantine or reject based on the record. Reporting and alignment visibility still make it valuable.

Can I add a human-readable note to the TXT value?

Use documented DMARC tags only. Add explanations in your DNS change record or documentation, not as unsupported text in the policy value.

For complete policy examples, see DMARC record examples.