Where do I publish the record?

Publish it as a single TXT record at the host _dmarc, so the full record name is _dmarc.yourdomain.com. The value is the whole v=DMARC1; … string. Changes take a few minutes to a few hours to propagate depending on your DNS provider and TTL.

Should I start with p=none, quarantine, or reject?

Start with p=none for a few weeks. It changes nothing about delivery but turns on aggregate reports, so you can see every source sending as your domain and confirm your legitimate mail passes. Once it does, move to p=quarantine (failing mail goes to spam), then finally p=reject (failing mail is blocked). Jumping straight to reject before your real mail is aligned can silently kill legitimate email — the reports are how you avoid that.

What are rua and ruf?

rua= is where aggregate reports go — daily XML summaries from receivers showing how much mail passed or failed DMARC, and from which sources. This is the address that actually matters; set it. ruf= is where forensic (per-message failure) reports go. Few providers send them, they can contain recipient data with privacy implications, and most domains leave ruf blank.

What does alignment (adkim / aspf) mean?

DMARC passes only when SPF or DKIM not only passes but is also 'aligned' — the domain it authenticates matches your From domain. Relaxed alignment (the default, r) allows subdomains to match; strict (s) requires an exact match. Relaxed is right for almost everyone; only use strict if you specifically need to disallow subdomain matching.

What's the pct tag for?

pct lets you apply your policy to only a percentage of failing mail during rollout — for example p=quarantine with pct=25 quarantines a quarter of failing messages and treats the rest with the next-weaker policy. It's a gradual-rollout safety valve. Return it to 100 (the default) once you're confident, so your policy actually covers all mail.

Does DMARC replace SPF and DKIM?

No — it depends on them. DMARC checks that SPF or DKIM passed and aligned with your From domain, then applies your policy. You need SPF and DKIM set up first; DMARC is the enforcement and reporting layer on top. Use our SPF generator and DNS Health Checker alongside this to get all three right.

§ FREE TOOL / DMARC RECORD BUILDER

Build a DMARC record that stops spoofing.

Pick a policy, point reports at a mailbox you own, tune alignment and rollout — and copy a ready-to-publish _dmarc TXT record. With guidance so you don't get stuck on p=none, or jump to reject before your real mail is ready.

Guided policy rollout Instant, no waiting No login required Runs in your browser

What should receivers do with mail that fails?

Where should reports go?

Aggregate reports (rua — recommended)

Daily XML summaries of who sent mail as your domain and whether it passed. Separate multiple addresses with commas.

Forensic reports (ruf — optional)

Per-message failure samples. Few receivers send these and they can contain recipient data, so most domains leave this blank.

Your DMARC record

v=DMARC1; p=quarantine

No rua= address set. Without an aggregate-report mailbox you get no visibility into who's sending — or spoofing — as your domain. Add one before enforcing.

How to publish this

Add one TXT record at the host _dmarc (so the full name is _dmarc.yourdomain.com) with the value above. A domain may have only one DMARC record. If you send the reports to a domain you don't own, that domain needs a matching authorisation record — most in-house setups report to their own domain, which needs nothing extra.

Free tool — nothing you type leaves your browser. Want to check an existing record too? Run the DNS Health Checker.

§ WHY IT MATTERS

SPF and DKIM check the mail. DMARC enforces the answer.

TXT record at _dmarc — the whole policy on a single line

policies to graduate through: none → quarantine → reject

logins, installs, or data sent anywhere — it all runs in your browser

§ HOW IT WORKS

Four choices, one enforced policy.

Choose a policy

Start at p=none to monitor, then graduate to quarantine and reject. We flag the trap of staying on none forever.

Add report addresses

Point rua= at a mailbox you control so you actually see who's sending — and spoofing — as your domain.

Tune the details

Optionally set subdomain policy, SPF/DKIM alignment, and a rollout percentage for a gradual, safe ramp-up.

Copy & publish

Copy the finished record and paste it as a single TXT record at the _dmarc host on your domain.

§ THE PRIMER

What DMARC is really doing

SPF and DKIM each answer a narrow question — did this server have permission to send, and was the message signed and unaltered. DMARC ties them to your visible From address and adds the two things they lack: an instruction for what to do when a message fails, and a stream of reports so you can see it happening. That's what turns authentication from a quiet background check into actual anti-spoofing protection.

The mistake almost everyone makes is treating p=none as the finish line. It blocks nothing — it only monitors. It exists so you can collect a few weeks of aggregate reports, confirm every legitimate source of your mail passes alignment, and then move up to quarantine and finally reject. Skip the reports and jump straight to reject and you risk silently dropping real mail; stay on none forever and spoofers sail right through.

This generator builds the record in the right tag order and nudges you toward a mailbox for your reports and a real enforcement policy — the two things that make DMARC worth publishing. Choose your settings, copy the line, and add it as a single TXT record at _dmarc.

DMARC is the third leg of the stool. Get SPF and DKIM solid first, publish DMARC on top, and verify your recipient list before each send — so a locked-down, trusted domain isn't paired with dead addresses and spam traps.

§ FAQ

DMARC record FAQ

What DMARC does, how to roll it out safely, and where the reports go.

Still have questions? Contact us

DMARC (Domain-based Message Authentication, Reporting & Conformance) is a TXT record that tells receiving mail servers what to do when a message claiming to be from your domain fails SPF and DKIM alignment — deliver it, spam-folder it, or reject it — and where to send reports about it. Without DMARC, anyone can spoof your exact domain in the From address, and you have no visibility into who's doing it. It's the piece that turns SPF and DKIM from passive checks into an enforced policy.

§ PROTECT YOUR DELIVERABILITY

Trusted domain. Clean list.

Lock down spoofing with DMARC, then verify your recipients before you send. Free plan includes 50 verifications a month — no card required.

Start for free

Build a DMARC record that stops spoofing.

Guided policy rollout Instant, no waiting No login required Runs in your browser

What DMARC is really doing