Publish one policy at the right DNS name.
For mail.example, publish TXT at _dmarc.mail.example. If your DNS panel appends the zone name automatically, enter only _dmarc. Replace an existing DMARC record instead of adding a second one. Split strings within one TXT record are concatenated; separate TXT records remain separate policies.
v=DMARC1; p=none; rua=mailto:reports@mail.example; adkim=r; aspf=r
This example uses a reserved domain and a mailbox that is not active. Substitute a verified report destination. A valid record requests reports but does not ensure receipt.
Explicit and inherited policies.
The inspector first checks the exact domain. Without a usable explicit policy, it uses the bounded RFC 9989 tree walk, with psd boundaries, to locate the organizational or public-suffix policy. Existing subdomains use sp when applicable; non-existent subdomains can use np. If a DNS query fails, the tool reports uncertainty instead of asserting that no policy exists.
RFC 7489 receivers can use PSL-based organizational domains and different inheritance. We do not claim identical behavior across receivers. Publish explicit policies for every sending domain when compatibility matters.
See your discovery traceExternal reporting authorization.
For a policy at mail.example reporting to reports@provider.example, an external receiver may need TXT authorization at mail.example._report._dmarc.provider.example starting with v=DMARC1. A wildcard may also answer that query.
The inspector shows exact DNS evidence. It does not prove that the mailbox accepts reports, fully resolve organizational equivalence for reporting domains, or follow destination overrides. An absent authorization TXT can be harmless within the same organizational domain; consult the report provider rather than blindly adding records.
The 2026 compatibility changes matter.
RFC 9989 obsoletes RFC 7489 and RFC 9091. It introduces np, psd and t, changes organizational-domain discovery and removes pct, ri and rf. A record without p defaults to none in the current standard, but older receivers may not treat it the same way.
Keep p explicit. Do not rely on t=y or a low pct for a risk-free rollout: older and current receivers differ. Start with p=none while you verify legitimate senders. Legacy !size suffixes on reporting URIs are obsolete and ignored by current receivers.
Standards and further reading.
- RFC 9989 — DMARC policy and discovery
- RFC 9990 — aggregate reports and external authorization
- RFC 9991 — failure reporting
- RFC 7489 — legacy receiver behavior
Maail’s tools are diagnostic aids, not cryptographic message validators or a universal receiver simulator. Review their data boundaries.