DMARC Record Generator

Always DMARC1. Identifies the record as a DMARC policy. Must be the first tag.

What receivers do with email that fails DMARC alignment. Start with none to collect data, then move to quarantine or reject once you're confident all legitimate senders are covered.

Applies to subdomains that don't have their own DMARC record (e.g. mail.example.com, promo.example.com). If omitted, subdomains inherit the main p policy. Set to reject early — attackers love sending from subdomains like secure.yourbank.com.

Controls how strictly the DKIM signing domain must match the From: header domain. Relaxed allows subdomains to align (e.g. mail.example.com aligns with example.com). Strict requires an exact match.

Controls how strictly the SPF envelope-from (Return-Path) domain must match the From: header domain. Relaxed is nearly always the right choice — strict breaks many legitimate sending setups like mailing lists and forwarding.

What percentage of failing messages the policy is applied to. The rest are treated as if the policy were none. Useful for a gradual rollout — start at 10, watch your reports, increase until you reach 100. Has no effect when p=none.

Where ISPs (Gmail, Outlook, Yahoo…) send daily XML reports summarising which servers sent email for your domain and whether it passed DMARC. Highly recommended — without this you're flying blind. You can list multiple addresses separated by commas.

Where ISPs send failure reports — message-level samples of individual emails that failed DMARC. Useful for debugging misconfigurations and catching spoofing attempts. Note: these reports may contain full email headers and sometimes body content. Many ISPs no longer send them. Leave blank if privacy is a concern or you don't need per-message detail.

Controls when a forensic report is generated. Only relevant when ruf is set. Default is 0 — report only when both SPF and DKIM fail. Setting 1 gives you reports whenever any check fails, which is more verbose but catches more edge cases.

How often (in seconds) you'd like aggregate reports. The default is 86400 (24 hours). Most ISPs ignore this and send once daily regardless. Only change this if you have a specific reason — leave at default for normal use.