Remove or fix the invalid tags in the DMARC record

Why it matters

Receivers skip parts of a DMARC record they do not understand, so the policy may not behave the way you intended. Typos in tag names and badly written report addresses are the usual causes.

The fix

1. The finding names the offending tags. The tags RFC 9989 defines are v, p, sp, np, adkim, aspf, rua, ruf, fo, t and psd; receivers ignore anything else (pct, rf and ri were removed). Check the values too: t takes y or n, np takes none, quarantine or reject.
2. Write report addresses as mailto: URIs (mailto:name@example.com), comma-separated, not as bare email addresses.
3. Write each tag once. Repeated tags are ambiguous.
4. Change only the tags named in the finding; leave p= as it is.
5. Edit the existing record in place and re-scan.

; keep your current p= value (p=none is shown as an example); fix only the tags named in the finding
_dmarc.example.com.  IN TXT  "v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com"

The examples use example.com. Replace it with your own domain.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the DMARC policy check
• Publish a DMARC record, starting in monitoring mode
• Keep only one DMARC record
• Fix the invalid DMARC record
• Move DMARC from monitoring to quarantine, then reject
• Move DMARC from quarantine to reject
• Remove the pct tag from the DMARC record
• Remove the t=y test flag from the DMARC record
• Make the DMARC subdomain policy match the main policy
• Add a report address to the DMARC record