How to use it
- Type your domain in Domain, such as example.com.
- Choose Policy for the domain (p). none only reports, so it is the right place to start.
- Type an address in Aggregate reports (rua) to receive the reports, then read them before you move to a stricter policy.
- Copy DMARC record (TXT) and publish it as a TXT record at Record name.
What a DMARC record says
A DMARC record is a TXT record at _dmarc followed by your domain (RFC 7489, section 6.1). It tells receivers what to do with mail that fails the DMARC checks for your domain, and where to send reports. It starts with v=DMARC1 and p, and the other tags follow, separated by semicolons (section 6.3).
- Unknown tags are ignored, and a tag at its default is left out of the record (section 6.3).
- Tags can come in any order after v and p (section 6.4). This page writes them in the order of the formal definition.
Policy, alignment and reports
p sets the policy for your domain, and sp, when it is given, sets it for subdomains only (RFC 7489, section 6.3). DMARC checks alignment: the domain of the From line must match the domain that passed DKIM or SPF. adkim and aspf choose relaxed or strict alignment for each check (sections 3.1 and 6.3). rua and ruf say where reports go, and an address must be a mailto address (section 6.3).
Starting a policy
p=none asks receivers to take no action on delivery and to send reports (RFC 7489, section 6.3). Read them to see which mail fails before any policy enforces something. The pct tag applies a policy to part of the failing mail, for a slow rollout; reports are always sent, whatever the percentage.
Example: a policy that refuses failing mail for example.com
The record v=DMARC1; p=reject; rua=mailto:[email protected] is published at _dmarc.example.com. It asks receivers to refuse mail that fails the DMARC checks and to send the aggregate reports to [email protected].
Tags left at their defaults are not written: the sp tag, the percentage and the alignment modes, so the record stays short.
| Measure | Value |
|---|---|
| Policy (p) | reject |
| Reports (rua) | mailto:[email protected] |
| Record | v=DMARC1; p=reject; rua=mailto:[email protected] |
| Host | _dmarc.example.com |
Frequently asked questions
Where do I publish the DMARC record?
As a TXT record at _dmarc followed by your domain, such as _dmarc.example.com (RFC 7489, section 6.1). The page shows the exact name under Record name.
Should I start with p=none?
p=none asks receivers to take no action and to send reports (RFC 7489, section 6.3), so you can see which mail fails before any policy enforces anything. Move to quarantine and then to reject when your real mail passes.
What does pct do?
pct sets the share of failing mail that the policy applies to, from 0 to 100 (RFC 7489, section 6.3). It supports a slow rollout, and reports are sent whatever the percentage.
What is the difference between relaxed and strict alignment?
Alignment decides how closely the From domain must match the domain that passed DKIM or SPF. Relaxed, r, is the default; strict, s, asks for a closer match. The modes are set separately for DKIM and SPF (RFC 7489, sections 3.1 and 6.3).
Why are there two policies, p and sp?
p applies to your domain and its subdomains. sp, when you give it, applies only to the subdomains and not to the domain itself (RFC 7489, section 6.3), so you can set a different strength for each.
Does this generator send my domain anywhere?
No. The record is built in your browser from what you type. Nothing is looked up on the network or stored, and the record is text for you to publish yourself.
Sources
- RFC 7489: Domain-based Message Authentication, Reporting, and Conformance (DMARC)
- RFC 5321: Simple Mail Transfer Protocol (addresses)
- RFC 5322: Internet Message Format (addr-spec)
Figures and text last checked on Tuesday, November 10, 2026.