Skip to content
inboxprobe

Checkers

Generators

Guides

Generators

DMARC record generator

A guided rollout: start by monitoring, then quarantine, then reject. Pick the stage you're at and get the exact record to publish.

Rollout stage

One address per line. A dedicated mailbox or a DMARC report service — reports arrive as daily XML files.

Advanced options

From the original DMARC spec (RFC 7489). RFC 9989 removed it; newer receivers may ignore it.

Your DMARC record

Type
TXT
Host / name
_dmarc
Value
v=DMARC1; p=none; rua=mailto:[email protected]

Publish as a TXT record at host _dmarc (full name _dmarc.yourdomain.com). Replace any existing DMARC record.

Why a rollout and not straight to reject

DMARC at reject blocks every message that fails alignment — including your own invoices from a billing tool nobody remembered to set up. The reports from the monitoring stage show you every source sending as your domain, with SPF and DKIM results for each, so you fix them before enforcement instead of finding out from customers.

StageRecordEffect on failing mailMove on when
1. Monitorp=none; rua=…Delivered normally, reportedEvery legitimate source passes (2–4 weeks)
2. Quarantinep=quarantine; rua=…Delivered to spamA few weeks with no legitimate failures
3. Rejectp=reject; rua=…RefusedStay here. Keep reading reports.

What the big mailbox providers require

Gmail, Yahoo and Outlook.com require bulk senders to publish DMARC with at least p=none, and for SPF or DKIM to align with the From domain. Stage 1 is enough for the requirement; stages 2 and 3 are what actually stop people spoofing your domain — and what you need for a BIMI logo.

Options most people should leave alone

  • Alignment (adkim, aspf): keep relaxed unless you have a reason. Strict breaks services that sign with a subdomain.
  • Subdomain policy (sp): defaults to your main policy. Only set it to be stricter than p during a transition — never sp=none once you enforce.
  • Failure reports (ruf): rarely sent by large providers, and they contain message details — mind your privacy obligations under GDPR.
  • pct / t=y: pct is from the original spec and was removed in RFC 9989 (May 2026) in favour of t=y. Receivers vary in which they honour, so prefer short, well-monitored stages over partial percentages.

Questions

Can I start directly with p=reject?

Only if you're certain every service sending as your domain passes SPF or DKIM with alignment. For a domain that never sends mail, yes — publish p=reject together with v=spf1 -all. For a working domain, start with p=none and reports.

What email address should I use for rua?

A dedicated mailbox (dmarc-reports@yourdomain) or a DMARC report service. Reports are machine-readable XML files, from a few to hundreds a day, so don't use a personal inbox.

Where do I publish the DMARC record?

As a TXT record with host _dmarc (full name _dmarc.yourdomain.com). There must be only one.

Does DMARC apply to my subdomains?

Yes. Subdomains without their own record inherit the sp= policy, or p= if sp isn't set. A subdomain can publish its own _dmarc record to override it.

Sources

Last reviewed: