DMARC record generator

Write the DMARC record of your domain one setting at a time: the policy, the share of mail it applies to, where reports go and how strictly SPF and DKIM must match. Start at p=none, then tighten.

The record is built in your browser: nothing you type is sent to us.

Your domain

DMARC tells receivers what to do with mail that claims to come from your domain but fails SPF and DKIM, and where to send their daily reports.

PolicyPolicy for subdomainsTest mode (t=y)With t=y, receivers that follow RFC 9989 treat reject as quarantine and quarantine as none. Receivers still on RFC 7489 ignore t= and apply the full policy.Send daily reports toOne or more addresses. Perimetry Cloud gives you one that reads them for you.Send failure reports to (optional)Few providers still send them, and they can contain personal data.DKIM alignmentSPF alignment

Legacy setting: pct (RFC 7489)

Share of mail the policy applies to (%)Obsolete since RFC 9989 and ignored by the receivers that follow it; some receivers still on RFC 7489 read it. Keep 100 and use t=y instead.

Check the record once published CAA, MTA-STS and security.txt generators

What the generator writes

The policy and its rollout: p= none, quarantine or reject; sp= for subdomains when it should differ; and t=y, the test mode of RFC 9989, while you try a stricter policy: receivers that follow it apply the policy one step lower (reject as quarantine, quarantine as none), and those still on RFC 7489 ignore t= and apply it in full. pct, the share of mail of the old standard, is tucked away as a legacy setting.
Report addresses: rua= for the daily aggregate reports and ruf= for failure reports, each written as a mailto: address, which receivers require.
Alignment: adkim= and aspf= appear only when you choose strict: relaxed is the default and is left out to keep the record short.
A warning for reports sent elsewhere: When a report address is on another domain, the generator tells you which authorisation record that domain must publish, or receivers will not send anything.
The right name: The record goes at _dmarc.<your domain>; the generator shows that name with your domain filled in.

How to roll DMARC out

Week 0: p=none with rua: Publish the record and read the aggregate reports: they list every server that sends mail as your domain.
Weeks 2 to 4: fix your senders: Every legitimate source must pass SPF or DKIM with your own domain. Set up DKIM for each service, or SPF with a custom return path.
Then p=quarantine: Forged mail goes to spam. Watch the reports for two to four weeks; nothing legitimate should fail.
Then p=reject: Forged mail is refused. Keep reading the reports: a service added later shows up there first.

Mistakes to avoid when writing a DMARC record

A DMARC record is short, but a few mistakes either stop your own mail or leave you blind. Each one below with how to avoid it.

p=reject on day one

Why. Newsletters, invoices or a helpdesk that are not aligned yet are refused at once, and you only learn it from customers.

Fix. Start at p=none with a rua address, and move on only when the reports show every legitimate source passing.

The record at the wrong name

Why. Published on the domain itself, or as _dmarc.example.com.example.com because the panel appends the zone: checkers then say No DMARC record found.

Fix. Name it _dmarc only; the panel adds the domain. Check it with the DMARC checker after publishing.

A report address without mailto:

Why. rua=dmarc@example.com is not valid: receivers send no report.

Fix. Write rua=mailto:dmarc@example.com. The generator adds mailto: for you.

Reports to another domain without its authorisation

Why. Receivers send reports to another domain only if it has published <your domain>._report._dmarc.<its domain>: otherwise they are silently dropped.

Fix. Use an address on your own domain, or a service that publishes the authorisation record for you.

Staying at p=none for years

Why. The record exists and reports flow, but forged mail is still delivered: checkers report DMARC policy not enabled.

Fix. Once the reports are clean, move to quarantine, then to reject. Perimetry Cloud tells you when each step is safe.

Strict alignment too early

Why. adkim=s or aspf=s fails services that sign or send with a subdomain, such as mail.example.com, although they are yours.

Fix. Keep relaxed alignment until the reports show that every source uses the exact domain.

Questions

Where do I publish the DMARC record?

As a TXT record named _dmarc on your domain; most DNS panels add the domain to the name themselves.

Which address should receive the reports?

A mailbox that you, or a tool, will read: aggregate reports are compressed XML files, several a day for a busy domain. Our DMARC report reader opens them in your browser, and Perimetry Cloud can receive and read them every day.

Should I ask for failure reports (ruf)?

It is optional. Few receivers still send them, and they can contain parts of messages and e-mail addresses, which is personal data. Aggregate reports are enough to roll DMARC out.

How long before moving to p=reject?

Usually four to eight weeks in total: two to four at none, then two to four at quarantine, as long as the reports show no legitimate source failing.

Is the record built on your servers?

No, in your browser. Nothing you type is sent to us.