DMARC Record Generator

A DMARC (Domain-based Message Authentication, Reporting & Conformance) record is a DNS TXT record published at _dmarc.yourdomain.com that defines how receiving mail servers should handle messages that fail SPF and DKIM authentication. It also provides a reporting mechanism — aggregate (rua) and forensic (ruf) reports — so domain owners can monitor who is sending email on their behalf. DMARC builds on SPF and DKIM; both must be correctly configured for DMARC to work.

p=none monitors authentication without affecting delivery — failing messages are delivered normally but reports are sent to your rua address. p=quarantine sends failing messages to the spam/junk folder. p=reject instructs receiving servers to discard messages that fail DMARC authentication outright. Start with p=none to collect data, review aggregate reports, fix authentication gaps, then progressively move to quarantine and finally reject for full protection.

Alignment requires that the domain in the From header matches the domain authenticated by SPF (envelope sender/Return-Path) or DKIM (d= tag). Relaxed alignment (aspf=r, adkim=r — the defaults) allows subdomain matches. Strict alignment (aspf=s, adkim=s) requires exact domain matches. At least one mechanism (SPF or DKIM) must align with the From domain for DMARC to pass. Misalignment is a common reason email passes SPF and DKIM but still fails DMARC.

The pct (percentage) tag specifies what proportion of messages that fail DMARC should have the policy (quarantine or reject) applied. pct=10 means the policy is applied to 10% of failing messages; the remaining 90% are treated as if the policy were none. This allows gradual rollout — start at pct=10, monitor reports for unexpected failures, then increase incrementally to pct=100. Once at pct=100 with no legitimate mail affected, your DMARC enforcement is complete.