DMARC record generator

A DMARC record is easy to write and easy to write badly. Each choice below says what it actually does, so you do not end up with a syntactically perfect record that accomplishes nothing.

Policy

What receivers should do with mail that fails both SPF and DKIM alignment.

Monitor only (p=none)Nothing is blocked. You receive reports. Start here.Quarantine (p=quarantine)Failing mail goes to spam. Move here once your reports are clean.Reject (p=reject)Failing mail is refused outright. The end goal.

Where should aggregate reports go?

Daily XML summaries of who is sending as your domain. Without this, a p=none policy tells you nothing.

Subdomains

Subdomains inherit the main policy unless you set this. Attackers prefer subdomains precisely because they are overlooked.

Advanced options

Apply the policy to 100% of failing mail

Lower this to ramp up enforcement gradually, then return it to 100%.

Alignment

Strict requires an exact domain match. Relaxed accepts subdomains and is right for almost everyone.

Strict DKIM alignmentStrict SPF alignment

Forensic report address (rarely needed)

Per-message failure reports. Very few providers send these, and they can contain message content.

Start at none, and then move

Publishing p=reject on day one will reject legitimate mail from any service you have forgotten about. The sequence that works is: publish p=none with a reporting address, read the reports for two to four weeks until every legitimate sender authenticates with alignment, then move to quarantine, then to reject.

Once published, confirm it resolves with the DMARC checker.