DMARC Checker

DMARC Record Generator: Build a Correct TXT Record

Updated

A DMARC record is one TXT record at _dmarc.yourdomain.com. It takes five minutes to write and one wrong character to break. The generator on this page builds it from a few choices; the rest of the page explains what each choice does, so you can defend it to a client or a boss.

Publish a TXT record at _dmarc.example.com

v=DMARC1; p=none

Pick the policy: none, quarantine or reject

p=none asks receivers to deliver as usual and only send reports. It satisfies the Gmail and Yahoo bulk sender rules and is the right first record for any domain that has never had one. p=quarantine sends failing mail to spam, p=reject refuses it. Move up only after a few weeks of reports show every legitimate sender passing. The pct tag applies the stricter policy to a share of mail first, say pct=10. The sp tag sets a separate policy for subdomains, which spoofers often pick when the main domain is locked down.

Where the reports go: rua and ruf

rua=mailto:address receives daily aggregate reports as XML attachments, one per receiver. Without it you publish a policy blind. ruf asks for copies of individual failing messages; most large receivers do not send them, so treat it as optional. If the report address sits on a different domain, that domain has to publish a small authorization record named after your domain and the full part after the @: for rua=mailto:[email protected] it is yourdomain.com._report._dmarc.example.net. Without it receivers drop the reports. A plain mailbox fills up fast; services that parse the XML for you start at around twenty dollars a month.

Alignment, syntax and the mistakes that get a record ignored

adkim and aspf default to relaxed, which accepts subdomains of the From domain; strict (s) wants an exact match and breaks more setups than it protects. The record has to start with v=DMARC1, and p must come second. Tags are separated by semicolons. Two DMARC records at the same name cancel each other out: receivers see more than one and apply none. After publishing, check the record with the tool on the home page and allow up to the TTL of your zone for the change to show everywhere.

Open the checker

Sources