Free DMARC Record Generator

What DMARC Is and Why It Completes the Authentication Picture

DMARC (Domain-based Message Authentication, Reporting and Conformance) builds on SPF and DKIM:

• SPF checks that the sending server is allowed to send for a domain.
• DKIM checks a cryptographic signature on the message.
• DMARC ties both results to the From address your readers see.

Without DMARC, a sender can pass SPF with their own domain in the envelope while putting your domain in the From address. DMARC is what lets receivers spot and stop that.

How a receiver evaluates it

The record lives at _dmarc.yourdomain.com. For each message, the receiver:

1. Runs the SPF and DKIM checks.
2. Checks alignment: does the domain that passed match the From domain?
3. Passes DMARC if at least one aligned check passes. If neither does, it applies your p= policy.

DMARC doesn't stop look-alike domains or fake display names. It protects your exact domain.

The reports

With a rua= address, receivers like Google, Microsoft and Yahoo send you daily XML reports. They list every IP that sent mail as your domain and whether SPF and DKIM passed, covering your own senders and anyone spoofing you.

Policy Progression: Moving from None to Reject

The p= tag sets what happens to mail that fails DMARC. The three values are steps, not alternatives:

1. p=none: no action, reports only. Stay here 2 to 4 weeks and read the reports.
2. p=quarantine: failing mail goes to spam. Watch it for a week or two.
3. p=reject: failing mail is blocked.

Don't jump straight to reject on a domain that never had DMARC. You'll block legitimate mail from senders you haven't found yet.

What to do while on p=none

The reports usually turn up forgotten senders: an old ESP, an internal app, a helpdesk. For each one:

• Add it to your SPF record (the SPF record generator builds it), or
• Make sure its DKIM signature aligns with your From domain.

A common rule of thumb is to move on once about 95% of your legitimate mail passes.

Staged rollout with pct=

pct= applies the policy to a share of failing mail. Going from pct=10 to 50 to 100 at quarantine limits the damage if you missed a sender. It defaults to 100, so set it explicitly for a staged rollout. It does nothing with p=none.

Alignment, Reporting Tags, and Where to Publish

Alignment (aspf= and adkim=)

Alignment decides how closely the authenticated domain must match the From domain:

• SPF is compared using the envelope-from (Return-Path) domain.
• DKIM is compared using the d= domain in the signature.

Each takes r (relaxed) or s (strict). Relaxed is the default and fits most setups: mail.yourdomain.com aligns with yourdomain.com. Strict needs an exact match.

Report addresses (rua= and ruf=)

• rua= gets the aggregate reports. Use a mailbox you read, or a report service. You can also paste a report into the DMARC report analyzer.
• ruf= gets per-message failure reports. Many large receivers don't send them, so don't rely on them.

If reports go to another domain, that domain must publish an authorization record. The generator above shows it when it's needed.

Where to publish

The record must be a TXT record at exactly _dmarc.yourdomain.com. Publishing it at yourdomain.com or dmarc.yourdomain.com means receivers never find it.

Subdomains follow the main policy unless you set sp=.

What DMARC Reports Reveal and How to Act on Them

Aggregate reports are one of the most useful and least read email diagnostics. Each one comes from a receiver and usually covers 24 hours. Inside you'll find:

• The source IP and how many messages it sent
• The SPF and DKIM results for that source
• Whether DMARC passed or failed

Common findings

• Your main ESP passes, but a secondary tool fails because its DKIM isn't set up (the DKIM record generator covers that).
• A transactional subdomain has no SPF record.
• A cloud service sends notifications from your domain without authentication.
• An old IP range is still in your SPF after the service was shut down.

Each one is a deliverability risk or a security gap you wouldn't find without the reports.

After you reach p=reject

The reports confirm enforcement works: your known senders should show almost no failures. What's left is spoofing or an edge case to look at.

Keep reading the reports. DMARC is ongoing work, not a record you publish once and forget.