MailTraceKit.me

DMARC · generator

DMARC Record Generator

Choose a policy, where reports should go and how strict alignment should be, and get a valid DMARC record with a plan for moving safely from monitoring to reject.

Build

updates as you type

Shows the exact record name and checks whether report addresses need an authorisation record.

Policy for mail that fails DMARC

Daily summaries of who sends as your domain. Strongly recommended. One address per line.

Copies of individual failing messages. Few providers send them, and they may contain personal data.

When to send failure reports (fo)
DKIM alignment (adkim)
SPF alignment (aspf)

Your DMARC record

Safe rollout plan

none → quarantine → reject

  1. Monitor for two to four weeks

    p=none with an aggregate report address. Reports show every server sending as your domain and whether it passes.

  2. Fix every legitimate sender

    Add missing services to SPF and turn on DKIM signing with your own domain for each of them, until the reports show them passing.

  3. Quarantine a share, then all

    p=quarantine starting at pct=25; raise it to 100 while reports stay clean.

  4. Reject

    p=reject: spoofed mail is refused before it reaches anyone.

Rolling out DMARC safely

Jumping straight to p=reject can block your own mail from a service you forgot to set up. The usual path is monitor, fix, quarantine, reject, as in the plan above. Aggregate reports (rua) are what make this safe: they arrive as XML files, roughly daily, from each large mailbox provider, and list every IP address that sent mail with your domain in the From line, with its SPF and DKIM results.

Publishing the record

Create a TXT record named _dmarc under your domain, for example _dmarc.example.com, with the generated value. Keep exactly one DMARC record: with two, receivers ignore both. Then confirm the live record with the DMARC checker, and check that SPF and DKIM pass with the domain health check.

If reports go to a mailbox on another domain, that domain has to accept them by publishing <your-domain>._report._dmarc.<their-domain> with the value v=DMARC1. Report services do this for you; for your own second domain, add it yourself.

Frequently asked questions

Where do I publish the DMARC record?

As a TXT record named _dmarc under your domain, for example _dmarc.example.com. Some DNS providers want only _dmarc in the host field and add the domain themselves.

How long should I stay at p=none?

Until the aggregate reports show that all legitimate mail passes, which usually takes two to four weeks of normal traffic. Monitoring forever gives no protection.

Should I ask for failure reports (ruf)?

It is optional. Few large mailbox providers send them, and they can contain parts of real messages, so only use an address whose handling of personal data you control.

Which alignment mode should I choose?

Relaxed, the default, works for almost everyone because it accepts subdomains such as mail.example.com. Strict only makes sense if subdomains must not be able to pass for the main domain.