Free DMARC record generator

What a DMARC TXT record does

A message passes DMARC when SPF or DKIM passes and that domain aligns with the domain in From (RFC 7489). The TXT record at _dmarc plus your domain tells receivers what to do when that check fails, and where to send reports. The value is a list of tags. v=DMARC1 must be first, and p= must be none, quarantine, or reject.

p=none requests no specific action, and receivers should not change delivery because of that policy. p=quarantine asks them to treat a failure as suspicious, which can mean the spam folder, extra scrutiny, or a suspicious flag. p=reject asks them to reject the message during the SMTP transaction. sp= is the same choice for subdomains of the domain where the record is published. If sp is left off, subdomains use p=. pct is the share of mail the policy applies to, and it defaults to 100. pct does not limit the reports.

rua is where aggregate reports go. If it is absent, receivers must not send aggregate reports. ruf is where message-specific failure reports go. If it is absent, receivers must not send those reports, and they ignore fo. fo is a colon-separated list: 0 when every underlying check fails to produce an aligned pass, 1 when any check is not an aligned pass, d when DKIM fails evaluation, and s when SPF fails evaluation. The default is 0. ri is the requested gap between aggregate reports, in seconds. The default is 86400, one day. Receivers must be able to send daily reports and should be able to send hourly reports. Anything other than daily is best effort.

adkim and aspf choose alignment. r is relaxed, the default: the authenticated domain and the From domain align when they share an Organizational Domain. s is strict: the full names must match. Organizational Domain is the registered domain under the public suffix, as defined in RFC 7489 section 3.2. No public suffix list is guaranteed to be accurate or current.

Roll out none, then quarantine, then reject

RFC 7489 Appendix B.2 starts with monitoring. Section 7 says feedback is what lets a Domain Owner use quarantine and reject. Use that order.

1. Publish p=none with a rua address. Receivers should not change delivery because of this policy. Read the aggregate reports until legitimate mail shows an aligned SPF or DKIM pass, and until you can see what a stricter policy would affect.
2. Move to p=quarantine. Failing mail should be treated as suspicious. pct can limit that to part of the stream. Appendix B.2.4 uses pct=25 with quarantine as a step before reject. Mail outside that percentage keeps the receiver's normal classification (section 6.6.4).
3. Move to p=reject once the reports show that mail you send aligns. Failing mail should be rejected during the SMTP transaction. If pct is below 100, mail that is not selected for reject should be treated as though the policy were quarantine (section 6.6.4).

Google's email sender guidelines require senders of more than 5,000 messages a day to Gmail accounts to publish a DMARC record. The policy can be none. For direct mail, the From domain must align with the SPF domain or the DKIM domain. Google recommends DMARC reports so you can monitor mail that uses your domain, including mail that only appears to come from it.

Yahoo requires bulk senders to publish a valid DMARC policy of at least p=none, and DMARC must pass. Relaxed alignment is acceptable. The From domain must align with the SPF domain or the DKIM domain. Yahoo strongly recommends a rua tag that can receive reports during initial setup.

If a rua or ruf address uses a different Organizational Domain from the domain in the record, that destination is external. The report receiver publishes a TXT record at your-domain._report._dmarc.report-host, and the value must start with v=DMARC1 (RFC 7489 section 7.1). Without it, receivers ignore that address. A receiver willing to take reports for any domain can publish v=DMARC1 at *._report._dmarc.its-own-domain. The addresses in the record are published in DNS, so use a mailbox you can filter (RFC 7489 section 6.5).

The tag rules on this page are from RFC 7489. The bulk-sender requirements are from Google's email sender guidelines and Yahoo's sender requirements.

After the TXT record is live, use the email DNS checker to read the DMARC record receivers will see.