A DMARC record generator builds the DNS TXT record that tells receiving servers what to do with mail that fails authentication and where to send reports. You choose a policy and reporting options, and the generator assembles the correct tag syntax defined by RFC 7489. The record is published at _dmarc.yourdomain.com and works on top of SPF and DKIM, checking that the domain a receiver sees aligns with the domain those methods authenticate.
What DMARC does
DMARC ties SPF and DKIM together with a rule for the visible From domain. When a message arrives, the receiver checks whether SPF or DKIM passes and whether the passing domain aligns with the From address. Your DMARC policy then instructs the receiver to allow, quarantine, or reject mail that fails. It also asks receivers to send aggregate reports, which show you every source sending as your domain, legitimate or not.
The main tags explained
- v=DMARC1 identifies the record version and must come first.
- p= is the policy for your domain: none to monitor, quarantine to send failures to spam, or reject to block them.
- rua= is the address for aggregate report data, the feedback that shows all your sending sources.
- ruf= is the address for forensic or failure reports, used less often for privacy reasons.
- pct= sets the percentage of failing mail the policy applies to, useful for a gradual rollout.
- sp= sets a separate policy for subdomains, and adkim= and aspf= control strict or relaxed alignment.
Safe defaults and a staged rollout
Start at p=none with a reporting address so you collect data without affecting delivery. Read the aggregate reports until every legitimate source passes and aligns, then move to p=quarantine, and finally to p=reject once you are confident. Rushing to reject before your sources are verified can block real mail. This staged path is the standard way to reach enforcement safely, and it is also the level BIMI needs before your logo can display.
A correct record
Enforced DMARC example
v=DMARC1; p=reject; rua=mailto:rua@example.com; pct=100; adkim=s; aspf=s
Generate yours with EmailAuth
EmailAuth generates a correct DMARC record from a free domain scan, reading your existing SPF, DKIM, and DMARC setup and filling the tags with values that match how you actually send. It hosts DMARC, BIMI, and MTA-STS records by CNAME delegation, so you update the policy from a dashboard as you move from monitoring to enforcement. The platform also parses your aggregate reports into a readable view, so you can see each sending source and know when it is safe to tighten the policy.
Frequently asked questions
Where do I publish a DMARC record?
Publish it as a DNS TXT record at the hostname _dmarc.yourdomain.com. The value starts with v=DMARC1 followed by your policy and reporting tags. Only one DMARC record is allowed per domain.
What is a safe DMARC policy to start with?
Start with p=none plus a rua reporting address. This monitors your mail without affecting delivery so you can see every sending source. Move to p=quarantine, then p=reject, once your legitimate sources all pass and align.
Do I still need SPF and DKIM with DMARC?
Yes. DMARC does not replace them; it builds on them. A message passes DMARC when SPF or DKIM passes and the authenticated domain aligns with the From address. Without working SPF and DKIM, your own mail will fail DMARC.
What does the pct tag do?
The pct tag sets the percentage of failing mail your policy applies to, from 1 to 100. Some senders use a lower value to phase in quarantine or reject, then raise it to 100 once results look clean. If omitted, it defaults to 100.
[ Get a free DMARC assessment ]
Free DMARC assessment
We check your domain and send a short report with the steps to full enforcement.