DMARC Record Generator

Before you generate a DMARC record

DMARC evaluates whether the domain visible in the From address aligns with a domain authenticated by SPF or DKIM. It also publishes a requested handling policy and can direct aggregate reports to a mailbox you control. DMARC does not replace SPF or DKIM, and a strict policy applied before every legitimate sender is known can reject genuine mail.

A safe rollout

1. Inventory every service that sends as your domain.
2. Make sure SPF and DKIM are passing and aligned.
3. Begin with p=none and a reporting address.
4. Review aggregate reports for a representative period.
5. Use current provider guidance and human review before any enforcement change.

RFC 9989 removed the former pct tag. Do not assume a percentage value reliably limits how receivers apply quarantine or reject. The current standard also advises general-purpose email domains not to deploy p=reject; receiver and provider compatibility still needs checking.

Worked example

v=DMARC1; p=none; rua=mailto:dmarc@example.com requests monitoring reports without asking receivers to quarantine or reject failing messages. Replace the example mailbox with one prepared to process DMARC XML reports. Publishing a reporting address can disclose that address publicly in DNS.