How to use the DMARC generator
- Choose a policy.
nonemonitors,quarantinesends failing mail to spam,rejectblocks it. - Add a report address. Aggregate reports arrive as XML files, often daily, from each receiver that sees your mail. Use a dedicated mailbox or a DMARC reporting service.
- Leave the advanced settings at their defaults unless you have a reason to change them: policy applied to 100% of mail, relaxed alignment.
- Copy the record and create a TXT record on the host
_dmarcin your DNS. - Verify it with the DMARC checker a few minutes later.
The DMARC tags explained
| Tag | Meaning |
|---|---|
v=DMARC1 | Version. Required and must come first. |
p | Policy for the domain: none, quarantine or reject. Required. |
sp | Policy for subdomains. Defaults to the main policy. |
rua | Where aggregate reports are sent, as mailto: addresses. |
ruf | Where forensic (failure) reports are sent. Optional and rarely sent today. |
pct | Percentage of failing mail the policy applies to. Defaults to 100. |
adkim / aspf | DKIM and SPF alignment: r (relaxed, default) or s (strict). |
Common mistakes
- Publishing the record on the root domain instead of
_dmarc. - Publishing two DMARC records. Receivers then ignore both.
- Jumping straight to
p=rejectbefore every sending service passes, which blocks your own invoices, password resets or newsletters. - Forgetting the
mailto:prefix inrua.
After DMARC: keep bounces low
With SPF, DKIM and DMARC in place, list quality becomes the biggest lever on inbox placement. Sending to invalid addresses raises your bounce rate and lowers the reputation your authentication helped build. Verify lists before campaigns and check new sign-ups as they arrive.