DMARC Record Generator

v=DMARC1; p=none

What DMARC actually does on top of SPF and DKIM

SPF says which servers may send for your domain. DKIM signs the message so tampering shows. Useful, both of them. But here's the gap nobody tells you about: neither one checks the From address your recipient actually sees. A phisher can pass SPF on their own domain while displaying yours in the From header, and plenty of filters wave it through.

DMARC closes that gap with alignment. It demands that the domain in the visible From header matches the domain that passed SPF or DKIM. No match, no pass. And then, this is the part I like, it lets you tell receiving servers what to do with the failures and asks them to send you reports about it. Suddenly you can see who's sending as your domain. Some of it will be you (a forgotten newsletter tool, the CRM, that one marketing platform). Some of it won't be. If you want a wider look at where your domain stands across all three mechanisms, an email authentication posture checker grades the whole setup in one pass.

Reading the policy levels honestly

The marketing version is "none, quarantine, reject, just pick reject for max security". The honest version is messier.

p=none blocks nothing. It's purely a reporting tap, and that's exactly why it's valuable. You run it for a few weeks and discover every system that sends mail as your domain, including the three you forgot existed. I've genuinely never seen a domain where the first batch of reports held zero surprises.

p=quarantine asks receivers to treat failures as suspicious, which in practice means the spam folder. It's the recoverable middle ground. A legitimate sender you missed lands in spam instead of vanishing, and someone will eventually tell you.

p=reject bounces failing mail at the door. It's the right end state for most domains, and it's also where invoices from your billing system silently stop arriving if you rushed. Reject isn't braver than quarantine. It's just less forgiving.

The staged rollout I recommend

This is the same sequence baked into the preset buttons above, and I'd argue the timeline matters more than the tags.

• Weeks 1 to 4: p=none with rua set. Collect reports. Fix SPF and DKIM for every legitimate source you find. Don't touch the policy until the reports look boring.
• Weeks 5 to 8: p=quarantine with pct=25. Only a quarter of failing mail gets quarantined, so a mistake stings instead of bleeding. Raise pct in steps (50, then 100) as the reports stay clean.
• After that: p=reject. Keep rua in the record forever. New SaaS tools that send mail as your domain will appear, usually without anyone telling IT.

Honestly, the four week monitoring window is a floor, not a target. Big org with decades of shadow IT? Make it three months. I might be overly cautious here, but I've never once regretted a slow DMARC rollout, and I've watched a fast one eat a week of payroll notifications.

Common mistakes I keep seeing

Publishing the record at the root domain instead of the _dmarc subdomain. The record itself is perfect, DNS just serves it from the wrong name, and every receiver ignores it.

Skipping rua entirely. A policy without reports means you're enforcing rules against traffic you cannot see. When something legitimate starts failing, your first clue is an angry phone call.

Jumping straight to p=reject because a compliance checklist said so. The checklist isn't wrong about the destination, just the speed.

Two more, quicker: forgetting that rua addresses on a different domain need a verification record on the receiving side before reports flow (RFC 7489 calls this external destination verification), and setting strict alignment day one. Relaxed alignment passes mail from subdomains like mail.example.com; strict doesn't, and most setups rely on that without knowing it.

Frequently asked questions

Where exactly do I publish the DMARC record?

As a TXT record at _dmarc.yourdomain.com, with the underscore. Not at the root, not at www. In most DNS panels you enter just _dmarc as the name and the panel appends your domain automatically.

Does p=none do anything at all?

It blocks nothing, and that's the point. It switches on reporting so you can map every system sending as your domain before any enforcement starts. Skipping it is how legitimate mail gets bounced later.

What does pct actually control?

It asks receivers to apply your policy to only that percentage of failing messages. pct=25 with quarantine means roughly a quarter of failures get quarantined and the rest pass through. It only matters with quarantine or reject; combined with p=none there's nothing to throttle.

Do I need both rua and ruf?

You need rua. Aggregate reports are the whole feedback loop. ruf is optional and frankly unreliable, since most major providers stopped sending failure reports over privacy concerns. Set it if you want, just don't build your process around it.

What's the difference between relaxed and strict alignment?

Relaxed accepts an organizational domain match, so mail signed by mail.example.com aligns with a From of example.com. Strict demands an exact match. Relaxed is the default and the right call for almost everyone; strict breaks subdomain senders you forgot about.

How long until I see my first aggregate reports?

Usually within 24 to 48 hours, since most receivers send one report per day per domain. If nothing arrives after three days, check the record with a DMARC lookup tool and double-check the rua address for typos. Been there.