fo tells receivers which conditions should generate a failure report. It is a request, it applies only to ruf, and its four values are more different from each other than they look.
The four
| Value | Requests a report when… | Volume |
|---|---|---|
0 | DMARC fails — both SPF and DKIM failed to produce an aligned pass | Lowest. The default. |
1 | Either mechanism failed to align, even if the other passed and DMARC therefore succeeded | Much higher — includes messages that were delivered normally. |
d | DKIM failed to verify, regardless of alignment | Independent of DMARC outcome. |
s | SPF failed to verify, regardless of alignment | Independent of DMARC outcome. |
Values combine with colons: fo=d:s asks for both mechanism-level reports. fo=1 is the one to understand, because it changes the question from “what is being rejected” to “what is only surviving on one leg”.
Why fo=1 is the useful one
Under fo=0 you hear about a sender only once it is already failing DMARC — which, at p=reject, means once its mail is already being rejected. Under fo=1 you hear about a sender whose DKIM has started failing while SPF still carries it, before the remaining mechanism breaks too.
fo=0 report when the message failed DMARC
"tell me about outages"
fo=1 report when either mechanism failed to align
"tell me when a sender loses redundancy"Every one of the government and high-value records that publishes ruf at all uses fo=1 — gov.uk, hmrc.gov.uk, github.com, stripe.com, irs.gov. That is not coincidence: if you are going to request failure reports, the early-warning shape is the one worth requesting.
fo does nothing without ruf
fo governs failure reports only. A record with fo=1 and no ruf address requests reports and gives nowhere to send them. The BBC publishes fo=0 with no ruf — harmless, and it configures nothing.