DMARC Record Generator

1. Enter your domain and start with policy none — this changes nothing about delivery.
2. Add an aggregate (rua) address. This is where the daily reports of who sends as your domain are sent.
3. Publish the record as a TXT record at the host _dmarc.
4. Watch the reports for a few weeks, fix any legitimate senders that fail, then escalate to quarantine and finally reject.

• p=none — monitoring. You receive reports but delivery is untouched. Stay here until your mail is clean.
• p=quarantine — failing mail goes to spam. Optionally ramp with pct (e.g. 25, then 50).
• p=reject— failing mail is blocked. The goal state, once you’re confident.

DMARC only passes when SPF or DKIM not only pass but align — the domain they authenticate matches the From: domain. relaxed alignment (the default) accepts subdomains; strict requires an exact match. Most senders should leave both on relaxed. So before DMARC can do anything useful, make sure your SPF and DKIM are in place and aligned.

ruaaggregate reports are daily XML summaries of pass/fail counts by source — this is what you’ll actually use to find unauthorized or misconfigured senders. ruf forensic reports contain individual failing messages, but most major mailbox providers no longer send them, so don’t rely on them.