DMARC generator
/dmarc/generatorBuild a record step by step, from p=none to p=reject.
What DMARC does
- What it is
DMARC ties SPF and DKIM together and tells receivers what to do when a message fails both.
- Why it matters
It turns "this looks wrong" into a clear instruction: monitor, quarantine, or reject.
- Without it
Without DMARC, failing mail is a judgement call for each receiver — so spoofed mail often still lands in the inbox.
How to roll out DMARC safely
Start at p=none and collect reports. Once you can see every legitimate sender and they're aligned, move to p=quarantine — optionally ramping pct from a small number up to 100. Only then move to p=reject for full protection.
Common questions
What is the rua address for?
It's where receivers send daily aggregate reports. Point it at an inbox or a DMARC reporting service so you can watch alignment before enforcing.
Which policy should I start with?
p=none. It changes nothing about delivery and only asks receivers to send reports. Move to quarantine, then reject, once the reports show every legitimate sender passing.
What do adkim and aspf do?
They set how closely the DKIM signing domain and the SPF domain must match the From domain. Relaxed (the default) accepts subdomains; strict requires an exact match. Leave them relaxed unless you know every sender uses your exact domain.