DMARC Record Builder

Build a DMARC record, or enter a domain to load and check its current one. The record goes in a TXT record at _dmarc.yourdomain.

Builder

Domain
Policy (p)
Subdomain policy (sp)
Percentage (pct)
Aggregate reports to (rua) - comma separated
Forensic reports to (ruf) - optional, few receivers send them
DKIM alignment (adkim)
SPF alignment (aspf)
Failure reporting (fo)
Report interval (ri, seconds)

Your record

Type	TXT
Host / Name	Some DNS editors want just `_dmarc` - they add the domain themselves.
Value

Tag reference

Tag	Meaning
`v=DMARC1`	Version. Must be first.
`p`	What receivers do with mail that fails DMARC: `none` (deliver, just report), `quarantine` (junk folder), `reject` (bounce). Required.
`sp`	Policy for subdomains. Defaults to `p`.
`pct`	Percentage of failing mail the policy applies to. Use it to ramp up quarantine/reject gradually. Default 100.
`rua`	Where daily aggregate (XML) reports go. Essential - this is how you find every service sending as your domain.
`ruf`	Where per-message failure reports go. Most big providers (Google, Microsoft) don't send these.
`adkim` / `aspf`	Alignment: relaxed lets `mail.example.com` align with `example.com`; strict requires an exact match.
`fo`	When to generate failure reports (only matters with `ruf`).
`ri`	Requested aggregate report interval. Default 86400 (daily); most receivers ignore other values.

A DMARC pass needs SPF or DKIM to pass and align with the From: domain. Recommended path: p=none with rua → fix every legitimate sender → quarantine (optionally with pct) → reject. Reports sent to an address on another domain need a yourdomain._report._dmarc.otherdomain TXT record of v=DMARC1 on that domain.