Remove the pct tag from the DMARC record

Why it matters

pct was removed from DMARC in RFC 9989 and receivers never applied partial values reliably; remove the tag. Receivers that still honour it enforce only a share of failing mail, and receivers that follow the new standard ignore it and enforce all of it.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

1. Check the aggregate reports to confirm that legitimate mail passes DMARC. Receivers that follow RFC 9989 already ignore pct and apply the full policy to every failing message, so removing the tag only makes the other receivers do the same.
2. Only remove pct=; do not change p=. Keep your current p= value and every other tag as they are.
3. Edit the existing _dmarc record; do not add a second one.

; pct removed; keep your current p= (quarantine is shown as an example)
_dmarc.example.com.  IN TXT  "v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@example.com"

The examples use example.com. Replace it with your own domain.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the DMARC policy check
• Publish a DMARC record, starting in monitoring mode
• Keep only one DMARC record
• Fix the invalid DMARC record
• Move DMARC from monitoring to quarantine, then reject
• Move DMARC from quarantine to reject
• Remove the t=y test flag from the DMARC record
• Make the DMARC subdomain policy match the main policy
• Add a report address to the DMARC record
• Remove or fix the invalid tags in the DMARC record