dmarc.syntax Reviewed July 2026

Quick fix

Use the scanner evidence to identify invalid, duplicate, missing, or misordered tags.

What this finding means

SecuTest parses known tags, requires `v=DMARC1` first and a valid `p` value, validates percentages, alignment modes, intervals, failure options, and mailto reporting URIs. A syntactically invalid record cannot be trusted as an enforcement policy.

Interpretation boundary Use the exact evidence in your report. SecuTest reports externally observable conditions; it does not assume ownership, exploitability, compromise, or business intent when those cannot be proven remotely.

Associated attack or threat scenario

Threat type DMARC policy invalidation and reporting failure

How the attack or failure scenario works

Malformed DMARC data causes receivers to ignore all or part of the policy. Forged messages may not receive the intended treatment, and aggregate reports may never reach the organization. This is a configuration defect rather than an active exploit.

Conditions and limitations

  • A malformed DMARC record is published at the correct DNS name.
  • A receiver evaluates the domain for a message using its visible From header.
  • Security impact depends on receiver fallback behavior and whether other filtering controls block the message.

Why it matters

Security and business impact Invalid DMARC tags, values, ordering, or reporting URIs can invalidate the policy and prevent reliable enforcement or reporting.

Step-by-step fix

Where to make the change

  • The authoritative DNS zone for the registrable domain.
  • The outbound or inbound mail platform when sender authorization, signing, or routing is involved.
  • The DMARC reporting mailbox or reporting service when aggregate reports are required.

Remediation procedure

  1. Use the scanner evidence to identify invalid, duplicate, missing, or misordered tags.
  2. Ensure the record begins with `v=DMARC1` and includes exactly one valid `p` value.
  3. Correct `pct`, `adkim`, `aspf`, `fo`, `ri`, `rua`, and `ruf` values using supported formats.
  4. Publish the corrected record as one logical TXT value and test external reporting authorization where required.

Commands and configuration examples

Replace example values with the hostname, selector, IP address, port, provider, or policy values shown in your SecuTest evidence. Review every example before production use.

Valid example
v=DMARC1; p=quarantine; pct=100; rua=mailto:dmarc-reports@example.com; adkim=r; aspf=r

Inspect record
dig +short TXT _dmarc.example.com

Verify the fix

  1. Run `dig +short TXT _dmarc.example.com` and reconstruct the complete record.
  2. Validate that `v` is first, `p` is present, and every reporting URI uses `mailto:`.
  3. Send a message and confirm the receiver reports `dmarc=pass` for a legitimate aligned sender.
  4. Confirm aggregate reports arrive and the SecuTest syntax check passes.
Confirm the externally visible result

After DNS, CDN, certificate, mail, or application propagation completes, run a fresh SecuTest scan and compare the new evidence with the original finding.

Re-scan your domain

Common mistakes

  • Using commas instead of semicolons between tags.
  • Omitting `mailto:` from `rua` or `ruf`.
  • Placing `p` before `v`, or publishing an empty tag value.

Authoritative references