DMARC Record Generator
Create a DMARC record to protect your domain's email. Free, no sign-up
What a DMARC record does
DMARC tells receivers what to do with mail that claims to be from your domain but passes neither SPF nor DKIM for it: let it through and report it (none), put it in spam (quarantine), or refuse it (reject).
It also asks receivers to send you reports. The daily ones are summaries in XML of every server that sent mail as your domain and whether it passed, which is how you find a forgotten sender before you tighten the policy.
Questions about this tool
Which policy should I start with?
p=none, with an address for reports. It changes nothing for your mail and shows you every server that sends as your domain. Tighten to quarantine and then reject once every real sender passes.
What are rua and ruf?
rua is where daily aggregate reports go: counts of mail by sending server and result, with no message content. ruf is for failure reports about single messages; few receivers send them, and they can include parts of the message.
Can reports go to an address at another domain?
Yes, but that domain must agree to receive them, with a TXT record v=DMARC1 at a name such as example.com._report._dmarc.reports.example.net. Report services set this up for you; for another domain of your own you add it yourself.
What does alignment mean?
DMARC passes only when SPF or DKIM passes for the same domain as the From address a person sees. Relaxed alignment lets a subdomain count (mail.example.com for example.com); strict needs the exact name. Relaxed suits nearly everybody.