DMARC record generator

Runs in your browser

DMARC is the record that ties SPF and DKIM to the address a reader actually sees, and tells receivers what to do when they do not match. Answer the questions and this builds the record, then says what each answer will do to your mail rather than leaving you to find out.

It is built in this page, on your machine. Nothing you type is uploaded, and nothing here queries DNS.

What should a receiver do with mail that fails?

Nothing — just send me the reportsp=none. Monitoring. Change nothing about delivery, and start finding out who sends mail as this domain. Where everyone should begin.Put it in the spam folderp=quarantine. The middle step. A failure is delivered but distrusted, so a mistake is recoverable by the recipient.Refuse it outrightp=reject. The destination. A failure is bounced and never reaches the recipient, so it is only safe once every legitimate sender is aligned.

Where should reports go?

One aggregate report per receiver per day, as compressed XML. Without this the record tells you nothing.

The rest of the tags

A different policy for subdomains

Subdomains inherit the policy above unless you say otherwise. Setting this to reject while the domain itself is at none is a common and useful pairing.

Apply the policy to a percentage only

1 to 99. Leave it blank for everything, which is the default and is what you want unless you are deliberately ramping up.

Strict alignmentDKIM must match the domain exactlyadkim=s. Relaxed alignment accepts a subdomain, which is what most senders need. Turn this on only when you know nothing legitimate signs as a subdomain.SPF must match the domain exactlyaspf=s. Same trade. A bulk platform bouncing from mail.example.com stops aligning the moment this is on.

Forensic reports (rarely worth it)

A copy of individual failing messages. Most large receivers never send them, so the usual result is the privacy exposure without the data.

Enter your domain above and the record will appear here.

What each answer costs

Start at none. It is not a cop-out.

p=nonechanges nothing about delivery and asks receivers to report what they saw. That is the entire point of it: until you have read a few weeks of reports you do not know who sends mail as your domain, and almost everyone is wrong about it. The invoicing tool, the recruiting platform, the thing marketing signed up for last year — these show up in reports and not in anyone’s memory.

p=quarantine is the middle step, and it is genuinely middle: a mistake lands in the spam folder, where the recipient can still find it. p=reject bounces the message, and a bounce is not recoverable by the person who needed it.

A record with no `rua` does nothing

This is the most common way to publish a DMARC record that looks like progress and is not. p=none with no reporting address changes no delivery and produces no information, so it is indistinguishable from having published nothing — except that a checker will now tell you DMARC is configured.

Point it at a mailbox you will actually read, or at one of the report-processing services. The volume is one compressed XML file per receiver per day, which is more than it sounds like and less than it looks like.

The footgun: reporting to someone else’s domain

If your rua address is not on the domain the record protects, RFC 7489 §7.1 requires that domain to publish a record authorising it — yourdomain.example._report._dmarc.theirdomain.example containing v=DMARC1. Without it, receivers check, find nothing, and drop the report.

Nothing tells you this has happened. There is no bounce and no error; the reports simply never arrive, and the usual conclusion is that nobody sends mail as your domain. This page names the exact record to publish whenever it sees an address that needs one.

Relaxed alignment is the default for a reason

Alignment is DMARC’s actual question: did the domain that passed SPF or DKIM match the domain in the From line. Relaxed accepts a subdomain, so a platform signing as mail.example.com still aligns with example.com. Strict requires the exact name.

Strict is not more secure in any way that matters — the attacker you care about controls neither — and it breaks legitimate senders, which is a real cost for an imagined benefit.

`ruf`sends you other people’s mail

A forensic report is a copy of an individual failing message, headers and often body, arriving at whatever mailbox you named. When the failure is a forwarded message from a real correspondent, that is their mail landing in a mailbox they never wrote to.

Most large receivers stopped sending them years ago for exactly that reason, so the usual outcome is the privacy exposure with none of the diagnostic value. Leave it out unless you have a specific reason and somewhere appropriate for it to go.

Where it goes, and what comes next

A TXT record on _dmarc under your domain. One record only: two is an error and neither applies.

Then the reports start arriving as compressed XML, which is where the other tools here take over — one of them turns an aggregate report into a table you can read without uploading it anywhere.

One of the free email tools.