Where is a DMARC record published?

A DMARC record is published as a TXT record at _dmarc.example.com for the domain being checked.

What does the DMARC p tag do?

The p tag tells receiving systems what policy to apply to mail that fails DMARC checks, with valid values of none, quarantine, and reject.

Moving too quickly to quarantine or reject can block legitimate mail if SPF or DKIM alignment is not already working correctly.

This page explains the main DMARC DNS tags that appear in DMARC policy records.

Tag	What It Does
`v=DMARC1`	Marks the TXT record as a DMARC policy record.
`p=`	Sets the main DMARC policy for the domain and tells receiving systems how to handle mail that fails DMARC alignment checks. Valid values are none, quarantine, and reject.
`sp=`	Optional subdomain policy. It tells receiving systems how to handle mail from subdomains that fails DMARC alignment checks. Valid values are none, quarantine, and reject. If omitted, subdomains inherit the main policy.
`rua=`	Optional aggregate report destinations, usually mailto: URIs.
`ruf=`	Optional forensic report destinations, usually mailto: URIs. Many email systems do not generate these reports because of privacy and security concerns.
`adkim=`	Defines DKIM alignment mode. r is relaxed and s is strict.
`aspf=`	Defines SPF alignment mode. r is relaxed and s is strict.
`pct=`	Applies the policy to a percentage of matching mail from 0 to 100.
`fo=`	Optional failure reporting options.
`ri=`	Optional requested interval for aggregate reports, in seconds.

A valid DMARC record normally includes at least v=DMARC1 and a p= policy.

v=DMARC1; p=none

An absolute minimum DMARC record. It publishes a DMARC policy in monitoring mode without requesting quarantine or rejection.

v=DMARC1; p=none; rua=mailto:dmarc@example.com

A common starting point when first deploying DMARC, because it enables aggregate reporting while keeping enforcement disabled.

v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com; pct=25

A staged rollout example. It asks receivers to quarantine failing mail, but only for 25% of matching traffic.

v=DMARC1; p=reject; rua=mailto:dmarc@example.com; adkim=s; aspf=s

A stronger enforcement example using reject policy and strict DKIM/SPF alignment.

v=DMARC1; p=reject; sp=quarantine; rua=mailto:dmarc@example.com

An example where the main domain uses reject, but subdomains use a softer quarantine policy.