How it works
DMARC (Domain-based Message Authentication, Reporting & Conformance) sits on top of SPF and DKIM. It tells receiving mail servers what to do with messages that claim to be from your domain but fail authentication, and where to send reports about that traffic. This tool assembles the resulting DNS TXT record from your choices, live and entirely in your browser.
Each control maps to one DMARC tag. The record always begins with v=DMARC1 and your policy p=; everything else is only appended when it differs from the default. Because relaxed alignment and pct=100 are the built-in defaults, the tool omits adkim, aspf and pct unless you change them. Report addresses you type are automatically given the mailto: prefix DMARC requires, and comma-separated addresses are supported.
To use it: choose a policy, add an rua= address you can actually read, copy the output, and publish it as a TXT record at the host _dmarc.yourdomain.com, not the domain apex. After a day or two, read the aggregate (XML) reports arriving at your rua address: each lists the sending IPs, message counts, and SPF/DKIM/alignment results for mail using your domain, exposing both legitimate senders and spoofing. The inline notes below the record flag the two most common mistakes: leaving p=none forever, and publishing with no reporting address at all.
DMARC tag reference & rollout path
| Tag | Purpose | Values & notes |
|---|---|---|
| v | Version | Must be DMARC1 and appear first. Required. |
| p | Policy for the domain | none (monitor), quarantine (spam), reject (block). Required. |
| sp | Policy for subdomains | Same values as p. If omitted, subdomains inherit p. |
| rua | Aggregate report address | URI(s) as mailto:. Daily XML summaries. Highly recommended. |
| ruf | Failure (forensic) report address | URI(s) as mailto:. Per-message detail; few receivers send these for privacy reasons. |
| pct | Percentage filtered | 0–100, default 100. Only affects quarantine/reject; skipped messages get the next-lower action. |
| adkim | DKIM alignment | r relaxed (default, allows subdomains) or s strict (exact match). |
| aspf | SPF alignment | r relaxed (default) or s strict. |
| fo | Failure report triggers | 0 report if all mechanisms fail alignment (default), 1 if any fails, d DKIM only, s SPF only. |
Rollout path: start at p=none with rua reporting to see who sends on your behalf; fix SPF and DKIM until legitimate mail aligns; move to p=quarantine, optionally ramping pct upward from a low value; then finish at p=reject once reports are clean. Never publish reject before your senders are aligned.
Frequently asked questions
Does DMARC require both SPF and DKIM to pass?
No. DMARC passes when either SPF or DKIM produces a passing result that is also aligned with the domain in the visible From header. Publishing both gives redundancy: when a forwarder breaks SPF, an aligned DKIM signature still carries the message.
Where exactly do I publish the record?
As a TXT record at the host _dmarc under your domain, i.e. _dmarc.yourdomain.com. Publish only one DMARC record per domain; multiple records cause DMARC to be ignored. Subdomains can have their own record or inherit the parent policy via sp.
What is the difference between relaxed and strict alignment?
Relaxed alignment (r) treats any subdomain as matching the organizational domain, so mail signed by mail.yourdomain.com aligns with yourdomain.com. Strict alignment (s) requires an exact match. Relaxed is the default and suits most organizations.
Why am I not receiving forensic (ruf) reports?
Failure reports can contain full message content, so most large mailbox providers do not send them for privacy reasons. Aggregate (rua) reports are the reliable data source; treat ruf as a bonus rather than something to depend on.
Will publishing DMARC block my legitimate email?
Not at p=none, that policy only monitors and never changes delivery. Blocking can only happen once you move to quarantine or reject, which is why you review aggregate reports and confirm every legitimate sender is aligned first.
p=none and confirm your SPF and DKIM setup with real aggregate reports before moving to quarantine or reject.