DMARC Record Generator

Start at p=none unless you already have reporting data

The policy tag tells receivers what to do when a message fails DMARC: nothing, quarantine, or reject. Publishing reject on a domain whose senders have never been inventoried is the most common way legitimate mail is lost, because every platform that sends for the domain without an aligned path is suddenly refused.

The safe sequence starts with p=none and an aggregate reporting address. Reports arrive daily from participating receivers and show which sources send as the domain and whether they align. Once every legitimate source has an aligned path, move to quarantine, then reject — optionally with pct to apply the stricter policy to a fraction of failures first.

• p=none blocks nothing; it collects evidence.
• Add rua before enforcing, or failures will be invisible.
• Use pct for a staged move from quarantine to reject.

Read the aggregate reports the rua address will receive

Alignment modes and subdomains are where surprises come from

Relaxed alignment lets a subdomain identity satisfy the policy for the organizational domain; strict requires an exact match. Most domains should stay relaxed. Strict is appropriate only when every sending path has been configured for the exact From domain and you have confirmed that with real messages.

The sp tag sets a separate policy for subdomains. It is easy to enforce reject at the apex and leave subdomains — which attackers invent freely — under a weaker inherited policy. If you set sp, confirm that every subdomain that sends mail has its own aligned path first.

Test alignment for a real sending path · See which policy a subdomain inherits

External reporting addresses need authorization

When rua points at a mailbox on a different domain, receivers check that the destination domain agrees to receive reports for yours. That agreement is a TXT record at yourdomain._report._dmarc.destination-domain. Without it, many receivers discard the reports silently and the policy appears to produce no telemetry.

Reporting services handle this for you by publishing the authorization on their side. If you run your own reporting mailbox on another domain you control, publish the record yourself. The generator flags every external address so this step is not forgotten.

Confirm the published record has propagated

Example: replacing a monitoring policy with enforcement

Known limits

• The generator validates syntax and explains effect; it cannot know which platforms send for the domain.
• Comparison uses the record at _dmarc only; inherited organizational policies are shown by the tree walk explorer.
• Receivers apply DMARC alongside their own filtering, so a published policy is a request, not a guarantee.

Common questions