DMARC Record Generator

Q: What is a DMARC record?

A DMARC record is a DNS TXT record published at _dmarc.yourdomain.com that tells receiving mail servers how to handle emails that fail SPF and DKIM authentication checks. It defines the policy (none, quarantine, or reject), reporting addresses, and alignment requirements for your domain's email authentication.

Q: Which DMARC policy should I use?

Start with p=none to monitor your email authentication without affecting delivery. Once you've reviewed aggregate reports and confirmed all legitimate senders pass SPF/DKIM, move to p=quarantine (sends failing emails to spam), and finally p=reject (blocks failing emails entirely). This gradual approach prevents accidentally blocking legitimate emails.

Q: What are DMARC reports?

DMARC provides two types of reports: Aggregate reports (rua) are daily XML summaries showing authentication results for all emails sent from your domain. Forensic reports (ruf) provide detailed information about individual emails that fail authentication. Aggregate reports are essential for monitoring; forensic reports help debug specific failures.

What is a DMARC record?

A DMARC record is a DNS TXT record published at _dmarc.yourdomain.com that tells receiving mail servers how to handle emails that fail SPF and DKIM authentication checks. It defines the policy (none, quarantine, or reject), reporting addresses, and alignment requirements for your domain's email authentication.

Which DMARC policy should I use?

Start with p=none to monitor your email authentication without affecting delivery. Once you've reviewed aggregate reports and confirmed all legitimate senders pass SPF/DKIM, move to p=quarantine (sends failing emails to spam), and finally p=reject (blocks failing emails entirely). This gradual approach prevents accidentally blocking legitimate emails.

What are DMARC reports?

DMARC provides two types of reports: Aggregate reports (rua) are daily XML summaries showing authentication results for all emails sent from your domain. Forensic reports (ruf) provide detailed information about individual emails that fail authentication. Aggregate reports are essential for monitoring; forensic reports help debug specific failures.

What is DMARC alignment?

DMARC alignment ensures the domain in the From header matches the domains used in SPF and DKIM checks. Relaxed alignment (default) allows subdomains to match the organizational domain. Strict alignment requires an exact domain match. Relaxed is recommended for most organizations as it's more flexible while still providing protection.

How do I add a DMARC record to my DNS?

Log into your DNS provider (e.g., Cloudflare, Namecheap, GoDaddy), create a new TXT record with the hostname _dmarc (or _dmarc.yourdomain.com depending on your provider), and paste the generated DMARC record value. DNS propagation typically takes 1-48 hours. Use our DMARC Checker to verify the record is published correctly.

Frequently Asked Questions

Related Tools

DMARC Checker

SPF Checker

DKIM Checker