← All tools
DMARC Generator
Pick your options and copy the record into a TXT at _dmarc.yourdomain.com.
Your DMARC record
Host
_dmarc.yourdomain.com
Start with p=none to monitor without affecting delivery, then tighten to quarantine and reject once your reports look clean.
Choosing the values
This builds a syntactically correct DMARC record from your choices. Correct syntax is the easy part - the decisions that matter are the policy you start at and whether anyone reads the reports. Everything runs in your browser; nothing is submitted.
- What should rua point at?
- An address that can handle gzipped XML arriving daily from dozens of providers - a parsing service or a dedicated mailbox, not a person. If rua is empty the record still works, but you have given up the one thing that tells you who is sending as your domain.
- What do adkim and aspf actually change?
- They set how strictly the authenticated domain must match the From domain. Relaxed, the default, allows a subdomain to align with its parent. Strict requires an exact match, which breaks the common pattern of signing with a subdomain, so leave it relaxed unless you have a reason.
- Can I just publish p=reject straight away?
- You can, and you will probably reject legitimate mail from a system you had forgotten about. The point of starting at none is that the reports show you those systems before the policy starts acting on them.