DMARC record generator

Every tag is optional except v and p. The generator leaves defaults out of the record rather than restating them, because a shorter record is easier to read and behaves identically.

Policy (p) — what receivers do with failing mail

Aggregate reports to (rua)

Subdomain policy (sp)

Non-existent subdomain policy (np)

DKIM alignment (adkim)

SPF alignment (aspf)

Percentage of failing mail the policy applies to (pct)

Forensic reports to (ruf) — optional, rarely sent

Failure reporting options (fo)

Your record

Where it goes

Publish as a TXT record at _dmarc.yourdomain.com — the _dmarc subdomain, not the domain itself. Publishing it on the root domain is the single most common DMARC mistake and results in no policy at all.

Start at p=none

Going straight to p=reject on a domain whose senders are not fully authenticated will destroy legitimate mail, silently, with no bounce you will see. Publish p=none with a rua address, read reports for three or four weeks, then tighten. The rollout guide covers each stage.

Every tag explained

v=Declares the record as DMARC. Must be the first tag, spelled exactly v=DMARC1. p=What a receiver should do with mail that fails DMARC. sp=A separate policy for subdomains. rua=Where daily XML summaries of authentication results are sent. ruf=Where per-message failure reports are sent. pct=What share of failing mail the policy applies to. adkim=How closely the DKIM signing domain must match the From: domain. aspf=How closely the SPF domain must match the From: domain. fo=Which failures trigger a forensic report. ri=How often you would like aggregate reports. rf=The format for forensic reports. np=A policy specifically for subdomains that have no DNS records at all.