Prerequisite
SPF Record Generator — authorize your sending IPs first
DMARC checks SPF alignment. Build (or double-check) your SPF record before enforcing a DMARC policy.
Open the toolFree tool · No account
DMARC Record Generator — enforce, don't just publish.
DMARC ties SPF and DKIM together and tells Gmail, Outlook and Yahoo exactly what to do when a message fails both. Build a record with a real rollout plan, not just p=none forever.
- No account needed
- Safe none → quarantine → reject rollout built in
- Compares against your live DNS
1. What should happen to mail that fails?
2. Aggregate reports (rua) — where daily pass/fail summaries go
Forensic reports (ruf) — optional, per-message failure detail
3. Rollout percentage
100%
Applies the policy to only this share of failing mail. Leave at 100% unless you're gradually rolling out enforcement.
Advanced — alignment mode
Relaxed (default) allows subdomain matches, e.g. mail.yourdomain.com aligns with yourdomain.com. Strict requires an exact match.
Your DMARC record
v=DMARC1; p=none ⚠ No rua address set — you'll get zero visibility into who is passing or failing DMARC on your domain. Nearly every DMARC rollout starts by adding one.
⚠ p=none with no reporting address does nothing but exist in DNS. Add an rua address to actually start monitoring.
How to publish this
- Go to your DNS provider
- Add a TXT record at host
_dmarc(e.g._dmarc.yourdomain.com) - Paste the record above as the value
- Start at
p=none, read your aggregate reports for 1-2 weeks, then move toquarantineand finallyreject
Compare against your live record
How this works
DMARC, in plain English.
What is DMARC actually for?
SPF and DKIM each verify one thing, but neither tells a mailbox provider what to do when a check fails, or whether the "From" address a human sees actually matches what was verified. DMARC adds that missing policy layer, plus a reporting channel so you can see who is sending mail as your domain — including attackers.
Why start with p=none?
p=none takes no enforcement action — it only turns on reporting. That lets you see, via aggregate reports, every legitimate source currently sending as your domain before you risk blocking any of it. Jumping straight to reject is how real marketing or support tool mail gets silently dropped.
What are aggregate reports (rua)?
Daily XML summaries most major mailbox providers send to your rua address, listing every sending source seen, and whether it passed SPF/DKIM alignment. Most teams pipe these into a parser or a tool like Brain rather than reading raw XML by hand.
Does DMARC alignment work differently from a plain SPF/DKIM pass?
Yes — alignment additionally requires the domain in SPF or DKIM to match the visible From address (exactly, in strict mode; or same organizational domain, in relaxed mode). A message can pass SPF and DKIM individually and still fail DMARC if neither one aligns with the From header.
A record is not a monitor
Someone still has to read the reports.
DMARC aggregate reports arrive as raw XML from every mailbox provider you send to. Brain parses them automatically, flags new unauthorized senders, and tells you when it's safe to move to the next enforcement level.