A DMARC record has eleven defined tags. Most published records use four of them, and the seven that are usually absent are absent for good reasons you should be able to state.
All eleven
| Tag | Default | What it does |
|---|---|---|
v | — | Version. Must be DMARC1 and must come first. |
p | — | Policy for the domain itself. Required. |
sp | inherits p | Policy for subdomains. |
np | inherits sp | Policy for subdomains that do not exist in DNS. |
rua | none | Where aggregate reports go. |
ruf | none | Where failure reports go. |
adkim | r | DKIM alignment mode. |
aspf | r | SPF alignment mode. |
pct | 100 | Percentage of failing messages the policy is applied to. |
fo | 0 | Which conditions generate a failure report. |
ri | 86400 | Requested reporting interval, in seconds. |
rf | afrf | Failure report format. |
The ones worth setting
Cloudflare states every default explicitly, which costs nothing and makes the intent readable to whoever inherits the record:
"v=DMARC1; p=reject; sp=reject; adkim=r; aspf=r; pct=100; rua=mailto:a1c47f179bc04efd8ee4dcd4d85dfc65@dmarc-reports.cloudflare.net,mailto:rua@cloudflare.com"
PayPal states almost nothing, and relies on the defaults doing what it wants:
"v=DMARC1; p=reject; rua=mailto:d@rua.agari.com,mailto:dmarc_agg@vali.email; ruf=mailto:d@ruf.agari.com,mailto:MTc4Mzcw@ruf.vali.email"
Both are correct. The difference is that the first survives being read by someone who does not know the defaults, and the second does not — most importantly for sp, which inherits p silently and is the tag people most often assume is set when it is not.
The ones you can ignore
| Tag | Why it is usually absent |
|---|---|
ri | Receivers send daily regardless. A shorter interval is a request nobody honours. |
rf | Only one format was ever defined. Setting it says nothing. |
pct | Ambiguously implemented, and a poor rollout tool for reasons that need their own lesson. |
ruf | Almost no receiver sends failure reports, and the few that do send personal data. |
The BBC sets ri=86400 and fo=0 — both exactly the defaults — which is harmless, and worth recognising as decoration rather than configuration when you meet it.
p is the only required tag besides v
v=DMARC1; p=none is a complete and valid record. It asks for nothing and reports nothing, which makes it the one shape genuinely not worth publishing — without rua you get no visibility, and p=none asks receivers for no action. RFC 7489 §6.3 defines the rest.