Generator · RFC 7489 · live check

DMARC generator

Choose what happens to mail that fails the checks and where the reports go. You get the record for _dmarc, checked: the tags, the report destinations and what the domain publishes now.

01The domain

Domain

02The policy

p=noneWatch only: no action, you get reports.
p=quarantineMail that fails is treated as suspect, usually sent to spam.
p=rejectMail that fails is rejected.

Subdomains (sp)

Share it applies to (pct)

03The reports

Aggregate reports (rua)

One or more addresses. The reports on who sent in the domain's name, and whether it passed, come here. You can read the reports with the analyzer.

Failure reports (ruf) optional fo=1 report any failure, not only when everything fails

04Alignment

DKIM r relaxed (default): subdomains are accepted too s strict: the exact domain only

SPF r relaxed (default): subdomains are accepted too s strict: the exact domain only

Alignment requires the domain checked by SPF or DKIM to match the one in From. Relaxed is the default (RFC 7489 section 3.1) and fits almost always.

Live preview

_dmarc.example.comTXT

v=DMARC1; p=none

Protection: none

From watching (none) to rejecting (reject).

p=noneWatch only: no action, you get reports.
p=quarantineMail that fails is treated as suspect, usually sent to spam.
p=rejectMail that fails is rejected.

The full check, with DNS, runs when you generate.

From watching to protection

p=none with rua: you get reports without affecting delivery, and learn from them every service that sends in the domain's name, to set up their SPF and DKIM.
p=quarantine, possibly with pct under 100 at first: pct exists precisely for a gradual rollout (RFC 7489 section 6.6.4).
p=reject: mail that fails DMARC no longer reaches the recipient. Keep reading the reports.

DMARC in short

What it does
DMARC (RFC 7489) ties the From domain to SPF and DKIM: a message passes when at least one of them passes and is aligned with From. The policy says what servers do with messages that do not.
The reports
Aggregate reports (rua) are XML files sent periodically by receiving servers about every message they saw with your domain. They tell you who sends in the domain's name.
Reports to another domain
If the report address is on another domain, that domain must accept explicitly by publishing v=DMARC1 at <your domain>._report._dmarc.<its domain> (RFC 7489 section 7.1). The generator checks it.
Subdomains
The policy also applies to subdomains without their own DMARC; sp gives them a separate one (RFC 7489 section 6.3).

Sources: RFC 7489

DMARC step by step: from p=none to reject