---
title: "DMARC ‘fo’ tag options and their meanings | DuoCircle"
description: "DMARC ‘fo’ tag options and their meanings."
image: "https://www.duocircle.com/images/og-default.png"
canonical: "https://www.duocircle.com/blog/dmarc/dmarc-fo-tag-options-and-their-meanings/"
---

Quick Answer

The fo tag in a DMARC record controls when failure (RUF) reports are generated. It has four values that can be combined. fo=0 (default) generates a report only when both SPF and DKIM fail to produce an aligned pass, capturing only hard failures. fo=1 generates a report whenever SPF or DKIM fails to produce an aligned pass, which surfaces every alignment issue and is the recommended setting for active troubleshooting. fo=d generates reports only on DKIM signature failures, regardless of alignment, useful when isolating DKIM problems. fo=s generates reports only on SPF failures, regardless of alignment. Failure reports include the sender IP, signing domain, timestamp, and the specific authentication and alignment results. If reports are not arriving despite a configured fo tag, check that the rua and ruf email addresses are correct and that the receiving provider supports failure reports (many do not send RUF for privacy reasons).

DMARC ‘fo’ tag options and their meanings

Your browser does not support the audio element.

[ Download episode](https://media.mailhop.org/duocircle/images/2025/03/DMARC-‘fo-tag-options-and-their-meanings.mp3) 

Share 

[ ](https://www.linkedin.com/sharing/share-offsite/?url=undefined%2Fblog%2Fdmarc%2Fdmarc-fo-tag-options-and-their-meanings%2F "Share on LinkedIn") [ ](https://twitter.com/intent/tweet?text=DMARC%20%E2%80%98fo%E2%80%99%20tag%20options%20and%20their%20meanings&url=undefined%2Fblog%2Fdmarc%2Fdmarc-fo-tag-options-and-their-meanings%2F "Share on X/Twitter") [ ](https://www.facebook.com/sharer/sharer.php?u=undefined%2Fblog%2Fdmarc%2Fdmarc-fo-tag-options-and-their-meanings%2F "Share on Facebook") [ ](https://reddit.com/submit?url=undefined%2Fblog%2Fdmarc%2Fdmarc-fo-tag-options-and-their-meanings%2F&title=DMARC%20%E2%80%98fo%E2%80%99%20tag%20options%20and%20their%20meanings "Share on Reddit") [ ](mailto:?subject=DMARC%20%E2%80%98fo%E2%80%99%20tag%20options%20and%20their%20meanings&body=Check out this article: undefined%2Fblog%2Fdmarc%2Fdmarc-fo-tag-options-and-their-meanings%2F "Share via Email") 

![DMARC ‘fo’ tag options](https://media.mailhop.org/duocircle/images/2025/03/sender-policy-framework-6824.jpg) 

The ‘fo’ tag in [DMARC](/resources/what-is-dmarc) stands for ‘failure options.’ It’s an optional tag that helps domain owners specify the types of authentication and alignment issues that must be reported. This tag supports four specific types of failure reports: **fo=0, fo=1, fo=d, and fo=s**. _The ‘fo’ tag can combine multiple reporting options, enabling you to create a customized reporting strategy that aligns best with your preferences and risk tolerance_. 

This optional tag defines how RUF reports should be generated. It’s important to regularly receive and analyze failure reports as they include crucial insights like:

- The sender’s IP address
- The **sending domain**
- The time of the message
- The cause(s) behind the authentication failure
- [SPF](https://autospf.com/) and DKIM alignment results

By strategically **analyzing the above information**, you find out which legitimate [mail servers](https://www.cloudflare.com/learning/email-security/what-is-a-mail-server/) are being subjected to false positives and why. Apart from this, you detect [malicious activities](https://www.voanews.com/a/us-sanctions-four-over-malicious-cyber-activity-for-iran-s-military-/7581894.html) being attempted in your name. 

## DMARC ‘fo’ tag options

There are **four ‘fo’ tag options**. Here’s what each of them means.

### fo=0 (default option)

When this option is used, DMARC failure reports are produced only if both SPF and [DKIM](/resources/what-is-dkim) don’t generate an aligned ‘pass’ result. Simply put, fo=0 generates reports only for hard authentication failures that you, as a **domain owner**, can’t afford to ignore. 

[![DMARC failure reports](https://media.mailhop.org/duocircle/images/2025/03/spf-record-check-5632.jpg)](https://media.mailhop.org/duocircle/images/2025/03/spf-record-check-5632.jpg)

### fo=1 (recommended option)

When fo=1 is used, [DMARC failure reports](/dmarc/causes-and-solutions-of-dmarc-failures/) are produced if SPF or DKIM doesn’t generate an aligned ‘pass’ outcome. This option is recommended as you get reports for all failure episodes and not just the severe ones. 

### fo=d (DKIM-specific option)

fo=d is used to specify that failure reports should only be generated for messages that fail DKIM signature evaluations, **irrespective of alignment status**. _This is ideal for the time period where you are only focusing on knowing and fixing DKIM-specific issues_. 

### fo=s (SPF-specific option)

This setting generates failure reports only for emails that fail SPF checks, irrespective of the alignment status. It’s ideal for domain owners who are focusing on **SPF-related issues**.

## When to use each failure reporting setting?

- Start with the default fo=0 setting so you are not bombarded with too many reports. Stick to this option until you have a proper process in place.
- Gradually proceed to fo=1 if you want more **comprehensive failure reports**.
- If you only want to focus on DKIM-related issues, choose fo=d.
- If you only want to focus on SPF-related issues, choose fo=s.
- You can combine options that best align with your [email authentication](/resources/email-authentication) goals.
- Don’t underrate the capabilities of failure reports. Keep evaluating them to see how different [ESPs](https://www.activecampaign.com/glossary/email-service-provider) perceive your domain.

[![how ESPs Perceive Your Domain](https://media.mailhop.org/duocircle/images/2025/03/dmarc-report-3432.jpg)](https://media.mailhop.org/duocircle/images/2025/03/dmarc-report-3432.jpg)

If you have opted to receive failure reports but are still not receiving them, then there is a chance that your [DMARC record](/resources/dmarc-records) has some misconfigurations. Here is what you **need to double-check** to start getting the RUA and RUF reports-

- You have entered correct email addresses in the RUA and RUF sections.
- The email provider supports failure reports.
- The ‘fo’ value is correctly configured as per your [email authentication](/resources/email-authentication) preferences.

_We understand how tedious it gets to fix misconfigurations, make adjustments, and evaluate reports all at once_. That’s why we **offer quality services** that take care of all this and more. [Please contact us](/contact) to know how we can help. 

We understand how tedious it gets to fix misconfigurations, make adjustments, and evaluate reports all at once. That’s why [DuoCircle](/) offers quality services that take care of **all this and more**. [Please contact us](/contact) to learn how we can help.

## Topics

DKIMDMARCspf 

![Brad Slavin](https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg) 

Brad Slavin 

General Manager

General Manager at DuoCircle. Product strategy and commercial lead across the email security portfolio.

## Secure your email infrastructure

Protect, authenticate, and deliver. Contact our team to find the right solution.

[Contact Sales](/contact/) [Explore Products](/products/) 

Share this article

[ ](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fwww.duocircle.com%2Fblog%2Fdmarc%2Fdmarc-fo-tag-options-and-their-meanings%2F) [ ](https://twitter.com/intent/tweet?text=DMARC%20%E2%80%98fo%E2%80%99%20tag%20options%20and%20their%20meanings&url=https%3A%2F%2Fwww.duocircle.com%2Fblog%2Fdmarc%2Fdmarc-fo-tag-options-and-their-meanings%2F) [ ](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.duocircle.com%2Fblog%2Fdmarc%2Fdmarc-fo-tag-options-and-their-meanings%2F) Copy 

Related Articles

- [ ![DMARC expert](https://media.mailhop.org/duocircle/images/2024/09/dmarc-report-5.jpg)  How to become a DMARC expert: a 6-step learning path DMARC ](/blog/dmarc/a-detailed-guide-on-becoming-a-dmarc-expert/)
- [ ![DMARC problems](https://media.mailhop.org/duocircle/images/2024/10/email-migration-service-8520.jpg)  A guide to detecting DMARC problems using the pentesting techniques DMARC ](/blog/dmarc/a-guide-to-detecting-dmarc-problems-using-the-pentesting-techniques/)
- [ ![BIMI](https://media.mailhop.org/duocircle/images/2025/06/spf-permerror-0123.jpg)  Avoiding common BIMI pitfalls: What goes wrong and how to fix it DMARC ](/blog/dmarc/avoiding-bimi-pitfalls-common-errors-and-how-to-fix-them/)
- [ ![Can threat actors bypass DMARC](https://media.mailhop.org/duocircle/images/2025/02/dmarc-generator-7302.jpg)  Can threat actors bypass DMARC? DMARC ](/blog/dmarc/can-threat-actors-bypass-dmarc/)

## Related Articles

[  DMARC 6m  How to become a DMARC expert: a 6-step learning path  Sep 24, 2024 ](/blog/dmarc/a-detailed-guide-on-becoming-a-dmarc-expert/)[  DMARC 6m  A guide to detecting DMARC problems using the pentesting techniques  Oct 3, 2024 ](/blog/dmarc/a-guide-to-detecting-dmarc-problems-using-the-pentesting-techniques/)[  DMARC 6m  Avoiding common BIMI pitfalls: What goes wrong and how to fix it  Jun 24, 2025 ](/blog/dmarc/avoiding-bimi-pitfalls-common-errors-and-how-to-fix-them/)[  DMARC 3m  Can threat actors bypass DMARC?  Feb 21, 2025 ](/blog/dmarc/can-threat-actors-bypass-dmarc/)

```json
{"@context":"https://schema.org","@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}],"sameAs":["https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://www.facebook.com/duocirclellc","https://www.g2.com/products/phish-protection-by-duocircle/reviews","https://github.com/duocircle","https://www.crunchbase.com/organization/duocircle-llc"],"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://support.duocircle.com"},"knowsAbout":["Email Security","Email Authentication","SPF","DKIM","DMARC","Phishing Protection","Spam Filtering","SMTP Relay","Email Deliverability","Email Forwarding"]}
```

```json
{"@context":"https://schema.org","@type":"WebSite","name":"DuoCircle LLC","url":"https://www.duocircle.com","description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}}
```

```json
[{"@context":"https://schema.org","@type":"BlogPosting","headline":"DMARC ‘fo’ tag options and their meanings","description":"DMARC ‘fo’ tag options and their meanings.","url":"https://www.duocircle.com/blog/dmarc/dmarc-fo-tag-options-and-their-meanings/","datePublished":"2025-03-05T19:13:43.000Z","dateModified":"2025-05-26T11:19:22.000Z","dateCreated":"2025-03-05T19:13:43.000Z","author":{"@type":"Person","@id":"https://www.duocircle.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://www.duocircle.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin runs DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. His focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://www.duocircle.com/blog/dmarc/dmarc-fo-tag-options-and-their-meanings/"},"articleSection":"dmarc","keywords":"DKIM, DMARC, spf","wordCount":583,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/duocircle/images/2025/03/sender-policy-framework-6824.jpg","caption":"DMARC ‘fo’ tag options","width":900,"height":600},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}},{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Blog","item":"https://www.duocircle.com/blog/"},{"@type":"ListItem","position":2,"name":"DMARC"},{"@type":"ListItem","position":3,"name":"DMARC ‘fo’ tag options and their meanings","item":"https://www.duocircle.com/blog/dmarc/dmarc-fo-tag-options-and-their-meanings/"}]}]
```

```json
{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://www.duocircle.com/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https://www.duocircle.com/blog/"},{"@type":"ListItem","position":3,"name":"DMARC","item":"https://www.duocircle.comundefined"},{"@type":"ListItem","position":4,"name":"DMARC ‘fo’ tag options and their meanings","item":"https://www.duocircle.com/blog/dmarc/dmarc-fo-tag-options-and-their-meanings/"}]}
```

```json
{"@context":"https://schema.org","@type":"BlogPosting","headline":"DMARC ‘fo’ tag options and their meanings","description":"DMARC ‘fo’ tag options and their meanings.","url":"https://www.duocircle.com/blog/dmarc/dmarc-fo-tag-options-and-their-meanings/","datePublished":"2025-03-05T19:13:43.000Z","dateModified":"2025-05-26T11:19:22.000Z","dateCreated":"2025-03-05T19:13:43.000Z","author":{"@type":"Person","@id":"https://www.duocircle.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://www.duocircle.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin runs DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. His focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://www.duocircle.com/blog/dmarc/dmarc-fo-tag-options-and-their-meanings/"},"articleSection":"dmarc","keywords":"DKIM, DMARC, spf","wordCount":583,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/duocircle/images/2025/03/sender-policy-framework-6824.jpg","caption":"DMARC ‘fo’ tag options","width":900,"height":600},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}}
```