---
title: "DMARC Record Example: What Should A Valid DMARC Record Look Like? | DMARC Report"
description: "Learn what a valid DMARC record looks like, explore real examples, understand key tags, and strengthen your domain’s email authentication and security."
image: "https://dmarcreport.com/og/blog/dmarc-record-example-what-should-valid-dmarc-record-look-like.png"
canonical: "https://dmarcreport.com/blog/dmarc-record-example-what-should-valid-dmarc-record-look-like/"
---

Quick Answer

A valid DMARC record is a DNS TXT record that starts with v=DMARC1 and defines an email policy using p=none, p=quarantine, or p=reject. It may also include reporting tags like rua to receive aggregate authentication reports from your domain.

Share 

[ ](https://www.linkedin.com/sharing/share-offsite/?url=undefined%2Fblog%2Fdmarc-record-example-what-should-valid-dmarc-record-look-like%2F "Share on LinkedIn") [ ](https://twitter.com/intent/tweet?text=DMARC%20Record%20Example%3A%20What%20Should%20A%20Valid%20DMARC%20Record%20Look%20Like%3F&url=undefined%2Fblog%2Fdmarc-record-example-what-should-valid-dmarc-record-look-like%2F "Share on X/Twitter") [ ](https://www.facebook.com/sharer/sharer.php?u=undefined%2Fblog%2Fdmarc-record-example-what-should-valid-dmarc-record-look-like%2F "Share on Facebook") [ ](https://reddit.com/submit?url=undefined%2Fblog%2Fdmarc-record-example-what-should-valid-dmarc-record-look-like%2F&title=DMARC%20Record%20Example%3A%20What%20Should%20A%20Valid%20DMARC%20Record%20Look%20Like%3F "Share on Reddit") [ ](mailto:?subject=DMARC%20Record%20Example%3A%20What%20Should%20A%20Valid%20DMARC%20Record%20Look%20Like%3F&body=Check out this article: undefined%2Fblog%2Fdmarc-record-example-what-should-valid-dmarc-record-look-like%2F "Share via Email") 

![DMARC Record Example](https://media.mailhop.org/dmarcreport/how-to-create-dmarc-record-5123-1788345314346.jpg) 

## Try Our Free DMARC Checker

Validate your DMARC policy, check alignment settings, and verify reporting configuration.

[ Check DMARC Record → ](/tools/dmarc-checker/) 

A valid DMARC record is a DNS TXT record published at `_dmarc.yourdomain.com` that begins with v=DMARC1; and **includes at least a policy** (p=none|quarantine|reject), for example: `v=DMARC1; p=reject; rua=mailto:dmarc@dmarcreport.com; ruf=mailto:forensics@dmarcreport.com; adkim=s; aspf=s; pct=100; fo=1; sp=quarantine; ri=86400`.

DMARC (Domain-based Message Authentication, Reporting, and Conformance) ties together SPF and DKIM to protect the visible From: domain, instructing receivers how to treat messages that fail authentication and alignment. _A valid record must live under the special \_dmarc host, be syntactically correct, and specify a policy; everything else is optional but recommended for real-world operations_.

The most effective DMARC deployments combine a staged rollout, disciplined SPF/DKIM alignment, and continuous report feedback loops. DMARCReport operationalizes this loop by collecting aggregate reports (rua), surfacing misaligned senders, recommending record changes, and guiding you from p=none monitoring to full p=reject enforcement with confidence.

## Minimal Valid DMARC Syntax and Clear Examples

A DMARC record is a single TXT entry at `_dmarc.example.com` containing **semicolon-delimited key=value** tags. Only v and p are strictly required, but reporting and alignment tags are foundational for success.

### Syntax Basics

- **Must begin with**: v=DMARC1
- **Required**: p=none|quarantine|reject
- **Optional (commonly used)**: rua, ruf, adkim, aspf, fo, sp, pct, ri, rf
- **Default behaviors if omitted**:  
   - adkim=r (relaxed), aspf=r (relaxed)  
   - fo=0 (forensic reports only when both SPF and DKIM fail with aligned results)  
   - ri=86400 (aggregate report interval in seconds—1 day)  
   - pct=100 (apply policy to 100% of messages)  
   - sp inherits p (subdomain policy inherits org domain policy)

_DMARCReport provides a record builder that validates ordering, quoting, tag names, and common pitfalls before you publish_.

### Minimal Valid Record

- Minimal, monitor-only: v=DMARC1; p=none

### Clear Example Records

- **Monitor (no enforcement)**: `v=DMARC1; p=none; rua=mailto:dmarc@dmarcreport.com; fo=1; ri=86400`
- **Quarantine suspicious mail**: `v=DMARC1; p=quarantine; pct=50; rua=mailto:dmarc@dmarcreport.com; adkim=r; aspf=r`
- **Full reject (strict alignment)**: `v=DMARC1; p=reject; adkim=s; aspf=s; rua=mailto:dmarc@dmarcreport.com; ruf=mailto:forensics@dmarcreport.com; fo=1; sp=quarantine; ri=86400`

DMARCReport confirms receiver acceptance of your new policy via **aggregate report deltas** and alerts you if misalignment spikes after changes.

![Staged Rollout with pct: How to Move Safely to Enforcement](https://media.mailhop.org/dmarcreport/dmarc-check-1563-1788345382573.jpg)

## Staged Rollout with pct: How to Move Safely to Enforcement

Phased enforcement reduces risk and builds confidence.

### Recommended Structure and Cadence

- **Phase 1 (2–4 weeks)**: p=none; rua configured; baseline sending sources; fix misalignments
- **Phase 2 (2–4 weeks)**: p=quarantine; pct=10 → 25 → 50; monitor false positives, continue source remediation
- **Phase 3 (2–6 weeks)**: p=reject; pct=10 → 50 → 100; turn on sp=reject or sp=quarantine for subdomains once sources are mapped

Suggested monitoring intervals:

- Evaluate rua XML daily, trend weekly
- Advance to next pct when unknown/misaligned traffic is <0.1% of total volume for at least 7 consecutive days

DMARCReport automates staged policies: it recommends pct steps based on observed alignment rates and flags risky sender **categories before you advance**.

## Alignment Modes in Practice: adkim and aspf

_Alignment determines how strictly the From: domain must match the domains authenticated by DKIM and/or SPF_.

### How adkim and aspf Work

- adkim=r (relaxed): DKIM d=child.example.com aligns with From: example.com
- adkim=s (strict): DKIM d= must exactly equal From: domain
- aspf=r (relaxed): SPF’s Return-Path child.example.com aligns with From: example.com
- aspf=s (strict): SPF Mail From/HELO must exactly match From: domain

### Deliverability Trade-offs

- **Relaxed (r)**: Higher deliverability, more tolerant to third-party senders and forwarding; slightly broader attack surface if a sibling domain is compromised
- **Strict (s)**: Strongest anti-spoof posture; requires rigorous vendor **configuration and consistent** use of the exact From: domain; forwarding-induced SPF breaks are more likely to trigger [DMARC fails](https://dmarcreport.com/blog/why-dmarc-fails-troubleshooting-guide-2026/) unless DKIM survives

Practical recommendation:

- Start relaxed (adkim=r; aspf=r) during p=none and early enforcement
- Migrate DKIM to strict (adkim=s) first; keep aspf=r if you rely on many [email service providers (ESP)](https://www.activecampaign.com/glossary/email-service-provider) that can’t set exact Return-Path
- Go strict on both only once all third parties are consistently aligned

DMARCReport’s alignment drill-down shows pass/fail by source, From: domain, DKIM d= domain, and Return-Path so you can choose relaxed vs strict per maturity level.

## Best Practices for Multi-Provider Sending

If you use [marketing platforms](https://www.indeed.com/career-advice/career-development/what-is-a-marketing-platform), transactional APIs, and CRM mailers, align each source methodically.

### Practical Steps

- **Enforce DKIM everywhere**:  
   - Generate unique DKIM selectors per provider (e.g., `s1._domainkey.example.com` for SendGrid, `k1._domainkey.example.com` for Mailchimp)  
   - Use 2048-bit keys; rotate every 6–12 months
- **Control SPF lookups**:  
   - Central record with includes; stay under the 10-[DNS-lookup](https://www.digicert.com/faq/dns/how-does-dns-lookup-work) limit  
   - Prefer DKIM alignment for DMARC pass because **SPF breaks on forwarding**
- **Use subdomains to segregate traffic**:  
   - marketing.example.com, txn.example.com, crm.example.com  
   - Publish per-subdomain DMARC (e.g., `_dmarc.marketing.example.com`)
- Set Return-Path to provider domains when needed, but ensure DKIM aligns to your From: domain

DMARCReport maintains a source inventory from rua data, highlights unknown IPs/providers, and recommends subdomain splits when a single [DMARC policy](https://dmarcreport.com/blog/what-is-a-dmarc-policy-and-how-does-it-affect-sending-my-emails/) must serve very different sender profiles.

![Reporting: rua and ruf the Right Way](https://media.mailhop.org/dmarcreport/dmarc-lookup-1023-1788345419249.jpg)

## Reporting: rua and ruf the Right Way

_DMARC reporting provides the visibility you need to enforce safely_.

### Configuring URIs and Formats

- **rua (aggregate)**: XML reports in zipped attachments (one per receiver per day), sent to mailto: addresses only, per RFC 7489  
   - Example: `rua=mailto:dmarc@dmarcreport.com`  
   - Optional size parameter: `rua=mailto:dmarc@dmarcreport.com!size=50m` (not all receivers honor size)
- **ruf (forensic/failure)**: Message-level AFRF reports (can contain redacted headers/body)  
   - Example: `ruf=mailto:forensics@dmarcreport.com; fo=1`  
   - Many large receivers limit or do not send ruf for privacy/volume; expect sparse coverage

Security and delegation:

- Always use a dedicated **mailbox or a trusted processor**; forensic reports may include sensitive data
- To delegate to a third party (like DMARCReport), publish their mailto: in rua/ruf; some receivers require DNS approval (external reporting authorization) via a verification record the processor provides

DMARCReport ingests rua at scale, normalizes provider-specific quirks, safely processes ruf with PII redaction, and exposes trends, top failing sources, geographies, and alignment causes.

## Common Publishing Mistakes and How to Troubleshoot

Avoid these high-frequency issues:

### Frequent Errors

- Duplicate DMARC [TXT record](https://en.wikipedia.org/wiki/TXT%5Frecord) at `_dmarc.domain` (publish exactly one)
- v=DMARC1 not first; receivers may ignore the record
- Malformed or unknown tags (e.g., “selector=”)—DMARC has no selector tag; that’s for DKIM
- Using HTTP/HTTPS in rua/ruf; only mailto: is standard
- Publishing at the wrong host (e.g., example.com instead of `_dmarc.example.com`)
- Overly long rua lists causing TXT bloat; use a distribution list or a processor address
- Expecting pct to work with p=none; pct is meaningful only for enforcement policies

### Quick Troubleshooting

- **Check with dig/host**:  
   - `dig txt _dmarc.example.com +short`  
   - `host -t txt _dmarc.example.com`
- **Validate online**:  
   - Use DMARCReport’s validator to lint tags, verify external reporting authorization, and simulate receiver parsing
- **Inspect receiver feedback**:  
   - Look for “failed to parse” or “no policy found” annotations in rua reports

DMARCReport’s pre-publish linting and continuous monitors alert you to **missing/duplicate records** and external authorization errors within minutes.

## SPF and DKIM to Support Strict DMARC

DMARC requires either SPF or DKIM to pass and align; in practice, DKIM is the primary lever for reliable alignment.

### DKIM Best Practices

- **Key length**: 2048-bit RSA (or stronger) to meet modern security standards
- **Multiple selectors**: s2025, s2026 to rotate without downtime
- Rotate keys every 6–12 months; remove stale selectors
- Use provider-managed DKIM only if they support 2048-bit and custom d= (your domain)

### SPF Best Practices

- Keep DNS lookup count ≤10 (includes a, mx, include, ptr, exists, redirect; each may expand)
- Flatten only with caution; prefer provider-maintained includes
- Sample large vendor set:  
   - `v=spf1 include:_spf.google.com include:spf.protection.outlook.com include:sendgrid.net include:servers.mcsv.net -all`
- Prefer DKIM alignment when possible due to forwarding behavior; keep **SPF as a complementary signal**

DMARCReport continuously checks [DKIM selector](https://dmarcreport.com/blog/what-is-the-difference-between-dkim-selector-and-domain-checking-dkim/) health (key size, presence, rotation status) and calculates SPF lookup counts, warning you before you cross limits that would break SPF evaluation.

![Vendor-Specific Considerations](https://media.mailhop.org/dmarcreport/dmarc-record-2036-1788346282423.jpg)

## Vendor-Specific Considerations

Align settings with how major platforms authenticate.

### Google Workspace

- **DKIM**: selector google; 1024 or 2048-bit; d=yourdomain.com
- **SPF**: `include:_spf.google.com`
- **Note**: Google supports BIMI with VMC; requires p=quarantine or p=reject
- **Example DMARC**: `v=DMARC1; p=quarantine; pct=25; rua=mailto:dmarc@dmarcreport.com; adkim=s; aspf=r`

### Microsoft 365 (Exchange Online)

- **DKIM**: `selector1._domainkey and selector2._domainkey` [CNAME (Canonical Name)](https://www.techtarget.com/it-infrastructure/definition/canonical-name-CNAME) to Microsoft hostnames
- **SPF**: `include:spf.protection.outlook.com`
- **Tip**: Enable DKIM per domain in Defender portal
- **Example DMARC**: `v=DMARC1; p=reject; rua=mailto:dmarc@dmarcreport.com; adkim=s; aspf=r; sp=reject`

### Mailchimp (marketing)

- **DKIM**: typically `k1._domainkey.yourdomain.com` CNAME to Mailchimp
- **SPF**: `include:servers.mcsv.net` (optional; DKIM usually suffices)
- Use subdomain (e.g., marketing.) **for clearer alignment**
- Example DMARC (subdomain): `v=DMARC1; p=quarantine; rua=mailto:dmarc@dmarcreport.com; adkim=s; aspf=r`

### SendGrid (transactional)

- **DKIM**: s1 and s2 selectors; CNAMEs to uXXXX.wl.sendgrid.net
- **SPF**: include:sendgrid.net
- **Ensure From**: domain matches the DKIM d=
- Example DMARC (subdomain): `v=DMARC1; p=reject; rua=mailto:dmarc@dmarcreport.com; adkim=s; aspf=r`

DMARCReport ships vendor templates and verifies each provider’s DKIM/SPF posture against your intended DMARC alignment before you flip to enforcement.

## DNS Constraints and Practical Workarounds

Publishing robust DMARC records must respect DNS realities.

### Constraints

- TXT strings max 255 characters per segment; multi-segment concatenation is allowed by quoting adjacent strings
- Overall TXT response size should be kept **modest to avoid fragmentation**
- **TTL**: start with 300–600s for testing; move to 1–4 hours in steady state
- **DNSSEC**: recommended to prevent tampering (not required for DMARC)

### Workarounds

- **Long rua lists**: use a single distribution address or a processor address (e.g., [dmarc@dmarcreport.com](mailto:dmarc@dmarcreport.com)) that expands internally
- **Multi-line TXT**: split with quotes; [DNS servers](https://www.cloudflare.com/learning/dns/what-is-a-dns-server/) concatenate automatically
- **Subdomain-specific DMARC**: move per-business-unit policies to subdomains to keep core record simple

_DMARCReport’s DNS assistant previews record size, suggests safe splits, and warns if your TXT might exceed common resolver thresholds_.

## DMARC, BIMI, and ARC: How They Interact

- **BIMI**: To display logos at participating receivers, you need:  
   - DMARC at enforcement (p=quarantine or p=reject) with strong alignment  
   - High [domain reputation](https://www.activecampaign.com/blog/domain-reputation) and consistent pass rates  
   - BIMI record at `default._bimi.yourdomain.com` pointing to an SVG  
   - [VMC (Verified Mark Certificate)](https://www.zoho.com/zeptomail/glossary/what-is-verified-mark-certificate.html) for Gmail and others
- **ARC (Authenticated Received Chain)**: Preserves authentication results across intermediaries/forwarders; not a DMARC bypass, but helps receivers trust re-mailed messages whose DKIM/SPF may have been altered

DMARCReport tracks BIMI readiness (DMARC enforcement, logo record presence) and surfaces [Authenticated Received Chain (ARC)](https://proton.me/blog/what-is-authenticated-received-chain-arc) validation patterns in rua data to explain **pass/fail variance on forwarded** mail.

## Case Studies and Data-Backed Insights

- Mid-market [Software as a Service (SaaS)](https://www.ibm.com/think/topics/saas) with six senders (Google Workspace, M365 relay, Mailchimp, SendGrid, CRM, support desk):  
   - Baseline p=none for 3 weeks: 8.2% of volume misaligned (mostly CRM bounce handling and support-forwarding)  
   - After DKIM fixes and subdomain split (marketing., support.): misalignment dropped to 0.27%  
   - Staged p=quarantine pct=25 → 50 over two weeks produced <0.02% false positives  
   - p=reject pct=100 at week 11; spoofed attempts dropped 96% within 30 days  
   - Ops impact: 5.6 hours/week of manual triage saved; rua volume averaged 1.4 MB/day compressed
- Retail brand enabling BIMI:  
   - **Precondition**: DMARC p=reject with adkim=s; aspf=r  
   - Achieved Gmail [BIMI (Brand Indicators for Message Identification)](https://docs.emaillabs.io/en/security-center/email-sending-security-and-authorization/bimi-brand-indicators-for-message-identification) display after VMC issuance; campaign open rates increased 2.1% over four weeks

DMARCReport provided the staged plan, a sender inventory, and automatic rua analytics that identified unknown IPs by ASN and country, accelerating the move to enforcement.

## FAQs

### What is the absolute minimal DMARC record I can publish?

- v=DMARC1; p=none is the minimal valid record. You should add rua quickly to gain visibility: `v=DMARC1; p=none; rua=mailto:dmarc@dmarcreport.com`.

### Does pct do anything if my policy is p=none?

- Not meaningfully. pct governs sampling for enforcement actions; with p=none there’s nothing to enforce. Use pct only **with p=quarantine or p=reject**.

### Should I use ruf forensic reports?

- Use them sparingly and securely. Many large receivers don’t send ruf for privacy reasons. If you enable ruf, ensure data handling compliance. DMARCReport can redact PII and route ruf safely.

### Do I need strict alignment (adkim=s; aspf=s) to reach p=reject?

- No. Many organizations run p=reject with adkim=s; aspf=r to accommodate third-party SPF constraints while maintaining strong DKIM alignment.

### How do I fix “duplicate DMARC records”?

- Consolidate into a single TXT at `_dmarc.yourdomain.com` that contains all needed tags. DMARCReport’s validator will **propose a merged record**.

![DMARC Master Class: From Setup to Full Enforcement](https://media.mailhop.org/dmarcreport/what-is-dmarc-1036-1788345456189.jpg)

## Conclusion: A Valid DMARC Record and How DMARCReport Gets You to Enforcement Faster

A valid DMARC record sits at `_dmarc.yourdomain.com`, starts with v=DMARC1;, and sets a clear policy (p=none|quarantine|reject) alongside alignment and reporting tags that match your sending reality—for example, `v=DMARC1; p=reject; adkim=s; aspf=r; rua=mailto:dmarc@dmarcreport.com; ri=86400`. To move from knowing to enforcing without breaking mail, you need disciplined rollout, precise SPF/DKIM alignment, and continuous feedback from rua/ruf.

DMARCReport is purpose-built to operationalize this journey:

- Record builder and DNS linting so your first publish is right
- Automated staged rollout recommendations using real rua data
- Source inventory and alignment analytics to fix issues before enforcement
- Vendor templates ([Google Workspace](https://jumpcloud.com/blog/what-is-google-workspace), M365, Mailchimp, SendGrid, and more)
- Secure report handling with privacy controls and alerting

Publish a correct record, measure relentlessly, and enforce confidently—[DMARCReport](https://dmarcreport.com/) turns DMARC from a static TXT entry into a managed, measurable control that protects your domain and improves deliverability.

![Brad Slavin](https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg) 

[ Brad Slavin ](/authors/brad-slavin/) 

General Manager

Founder and General Manager of DuoCircle. Product strategy and commercial lead for DMARC Report's 2,000+ customer base.

[LinkedIn Profile →](https://www.linkedin.com/in/bradslavin) 

## Take control of your DMARC reports

Turn raw XML into actionable dashboards. Start free - no credit card required.

[Start Free Trial](https://app.dmarcreport.com/signup?plan=free) [Check Your DMARC Record](/tools/dmarc-checker/) 

Scan Your Domain Now

Instantly scan your domain for DKIM, SPF, and DMARC issues

Check My Domain 

Share this article

[ ](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fdmarcreport.com%2Fblog%2Fdmarc-record-example-what-should-valid-dmarc-record-look-like%2F) [ ](https://twitter.com/intent/tweet?text=DMARC%20Record%20Example%3A%20What%20Should%20A%20Valid%20DMARC%20Record%20Look%20Like%3F&url=https%3A%2F%2Fdmarcreport.com%2Fblog%2Fdmarc-record-example-what-should-valid-dmarc-record-look-like%2F) [ ](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fdmarcreport.com%2Fblog%2Fdmarc-record-example-what-should-valid-dmarc-record-look-like%2F) Copy 

Related Articles

- [ ![10 Critical Learnings From Verizon’s 2021 DBIR - A DMARCReport Perspective](https://media.mailhop.org/dmarcreport/images/2022/04/dmarc-alignment-6379.jpg)  10 Critical Learnings From Verizon’s 2021 DBIR - A DMARCReport Perspective Foundational ](/blog/10-critical-learnings-from-verizons-2021-dbir-a-dmarcreport-perspective/)
- [ ![10 DNS Blacklist Insights That Improve Email Security And Deliverability Fast](https://media.mailhop.org/dmarcreport/images/2022/04/dmarc-alignment-6379.jpg)  10 DNS Blacklist Insights That Improve Email Security And Deliverability Fast Foundational ](/blog/10-dns-blacklist-insights-to-improve-email-security-and-deliverability/)
- [ ![10 Email Spoofing Detection Tools That Dramatically Improve Brand Protection](https://media.mailhop.org/dmarcreport/images/2022/04/dmarc-alignment-6379.jpg)  10 Email Spoofing Detection Tools That Dramatically Improve Brand Protection Foundational ](/blog/10-email-spoofing-detection-tools-that-dramatically-improve-brand-protection/)
- [ ![10 Reasons SPF Filtering Is Critical For Email Security](https://media.mailhop.org/dmarcreport/images/2022/04/dmarc-alignment-6379.jpg)  10 Reasons SPF Filtering Is Critical For Email Security Foundational ](/blog/10-reasons-spf-filtering-is-critical-for-email-security/)

## Related Articles

[  Foundational 8m  10 Critical Learnings From Verizon’s 2021 DBIR - A DMARCReport Perspective  Nov 25, 2025 ](/blog/10-critical-learnings-from-verizons-2021-dbir-a-dmarcreport-perspective/)[  Foundational 12m  10 DNS Blacklist Insights That Improve Email Security And Deliverability Fast  Nov 14, 2025 ](/blog/10-dns-blacklist-insights-to-improve-email-security-and-deliverability/)[  Foundational 12m  10 Email Spoofing Detection Tools That Dramatically Improve Brand Protection  Nov 11, 2025 ](/blog/10-email-spoofing-detection-tools-that-dramatically-improve-brand-protection/)[  Foundational 12m  10 Reasons SPF Filtering Is Critical For Email Security  Nov 19, 2025 ](/blog/10-reasons-spf-filtering-is-critical-for-email-security/)

```json
{"@context":"https://schema.org","@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com","logo":{"@type":"ImageObject","url":"https://dmarcreport.com/images/dmarcreport-logo.png"},"description":"DMARC reporting and email authentication management. Monitor aggregate and forensic DMARC reports, analyze authentication results, and enforce DMARC policies across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138898167","https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://www.g2.com/products/dmarc-report/reviews","https://github.com/duocircle","https://www.crunchbase.com/organization/duocircle-llc","https://www.trustradius.com/products/duocircle/reviews"],"aggregateRating":{"@type":"AggregateRating","ratingValue":"4.8","reviewCount":"471","bestRating":"5","worstRating":"1","url":"https://www.g2.com/products/dmarc-report/reviews"},"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://dmarcreport.com/support/"},"knowsAbout":["DMARC","DMARC Reporting","DMARC Aggregate Reports","DMARC Forensic Reports","Sender Policy Framework","DKIM","Email Authentication","Email Security","DNS Management","Email Deliverability"]}
```

```json
{"@context":"https://schema.org","@type":"WebSite","name":"DMARC Report","url":"https://dmarcreport.com","description":"DMARC reporting and email authentication management. Monitor aggregate and forensic DMARC reports, analyze authentication results, and enforce DMARC policies across all your domains.","publisher":{"@type":"Organization","name":"DMARC Report","url":"https://dmarcreport.com","logo":{"@type":"ImageObject","url":"https://dmarcreport.com/images/dmarcreport-logo.png"},"description":"DMARC reporting and email authentication management. Monitor aggregate and forensic DMARC reports, analyze authentication results, and enforce DMARC policies across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}}}
```

```json
[{"@context":"https://schema.org","@type":"BlogPosting","headline":"DMARC Record Example: What Should A Valid DMARC Record Look Like?","description":"Learn what a valid DMARC record looks like, explore real examples, understand key tags, and strengthen your domain’s email authentication and security.","url":"https://dmarcreport.com/blog/dmarc-record-example-what-should-valid-dmarc-record-look-like/","datePublished":"2026-09-02T00:00:00.000Z","dateModified":"2026-09-02T00:00:00.000Z","dateCreated":"2026-09-02T00:00:00.000Z","author":{"@type":"Person","@id":"https://dmarcreport.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://dmarcreport.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin is the founder and General Manager of DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. He founded DuoCircle in 2014 and has led the company's growth to 2,000+ customers across its email security product family. Brad's focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DMARC Report","url":"https://dmarcreport.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com","logo":{"@type":"ImageObject","url":"https://dmarcreport.com/images/dmarcreport-logo.png"},"description":"DMARC reporting and email authentication management. Monitor aggregate and forensic DMARC reports, analyze authentication results, and enforce DMARC policies across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138898167","https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://www.g2.com/products/dmarc-report/reviews","https://github.com/duocircle","https://www.crunchbase.com/organization/duocircle-llc","https://www.trustradius.com/products/duocircle/reviews"],"aggregateRating":{"@type":"AggregateRating","ratingValue":"4.8","reviewCount":"471","bestRating":"5","worstRating":"1","url":"https://www.g2.com/products/dmarc-report/reviews"},"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://dmarcreport.com/support/"},"knowsAbout":["DMARC","DMARC Reporting","DMARC Aggregate Reports","DMARC Forensic Reports","Sender Policy Framework","DKIM","Email Authentication","Email Security","DNS Management","Email Deliverability"]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://dmarcreport.com/blog/dmarc-record-example-what-should-valid-dmarc-record-look-like/"},"articleSection":"foundational","keywords":"","image":{"@type":"ImageObject","url":"https://media.mailhop.org/dmarcreport/how-to-create-dmarc-record-5123-1788345314346.jpg","caption":"DMARC Record Example"},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}},{"@context":"https://schema.org","@type":"FAQPage","mainEntity":[{"@type":"Question","name":"What is the absolute minimal DMARC record I can publish?","acceptedAnswer":{"@type":"Answer","text":"- v=DMARC1; p=none is the minimal valid record. You should add rua quickly to gain visibility: `v=DMARC1; p=none; rua=mailto:dmarc@dmarcreport.com`."}},{"@type":"Question","name":"Does pct do anything if my policy is p=none?","acceptedAnswer":{"@type":"Answer","text":"- Not meaningfully. pct governs sampling for enforcement actions; with p=none there’s nothing to enforce. Use pct only **with p=quarantine or p=reject**."}},{"@type":"Question","name":"Should I use ruf forensic reports?","acceptedAnswer":{"@type":"Answer","text":"- Use them sparingly and securely. Many large receivers don’t send ruf for privacy reasons. If you enable ruf, ensure data handling compliance. DMARCReport can redact PII and route ruf safely."}},{"@type":"Question","name":"Do I need strict alignment (adkim=s; aspf=s) to reach p=reject?","acceptedAnswer":{"@type":"Answer","text":"- No. Many organizations run p=reject with adkim=s; aspf=r to accommodate third-party SPF constraints while maintaining strong DKIM alignment."}},{"@type":"Question","name":"How do I fix “duplicate DMARC records”?","acceptedAnswer":{"@type":"Answer","text":"- Consolidate into a single TXT at `_dmarc.yourdomain.com` that contains all needed tags. DMARCReport’s validator will **propose a merged record**."}}]}]
```

```json
{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://dmarcreport.com/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https://dmarcreport.com/blog/"},{"@type":"ListItem","position":3,"name":"Foundational","item":"https://dmarcreport.com/foundational/"},{"@type":"ListItem","position":4,"name":"DMARC Record Example: What Should A Valid DMARC Record Look Like?","item":"https://dmarcreport.com/blog/dmarc-record-example-what-should-valid-dmarc-record-look-like/"}]}
```