tmailrDeliverability · DMARC
DMARC record generator
Build the TXT record that tells receivers what to do with mail that fails authentication while claiming to be from your domain. Nothing you type leaves your browser.
Your record
Create a TXT record at _dmarc.example.com with this value:
v=DMARC1; p=none
Without rua you will never see who is sending as your domain, which is the main reason to publish DMARC at all.
Before you tighten it
This publishes a policy that changes nothing yet, which is the right place to start. Leave it running for a few weeks with a reports address so you can see every service sending as your domain, including the ones nobody remembers setting up.
How to roll it out
Publish DMARC without breaking real mail
DMARC is the record that stops other people sending email as your domain, but flip it to reject too early and your own mail is what disappears. The generator defaults to monitoring and walks the safe path, so you tighten the policy only when the reports say it is safe.
Start at monitoring
p=none publishes a policy that changes nothing but turns on reporting. Run it for a few weeks with a reports address and you will see every service sending as your domain, including the ones nobody remembers setting up.
Tighten with the reports
Once the reports show every legitimate sender passing SPF or DKIM with alignment, move to p=quarantine, then p=reject. Each step only ever stops mail that was already failing.
Alignment matters
DMARC passes only when the domain that passed SPF or DKIM matches your From domain. Strict alignment requires an exact match; relaxed allows a subdomain. Most providers sign with their own subdomain, so check the reports before going strict.
Questions people actually ask
Straight answers
What is a DMARC record?
A DMARC record is a single TXT entry at _dmarc.yourdomain that tells receiving servers what to do with mail that fails SPF and DKIM while claiming to be from your domain: monitor it, send it to spam, or reject it. It also asks receivers to email you reports of who is sending as you.
What do p=none, quarantine and reject mean?
p=none only watches and reports, it changes nothing, and is where you start. p=quarantine sends failing mail to spam. p=reject refuses it outright. The safe path is none, then quarantine, then reject, tightening only once your reports show every real sender passing.
Will publishing DMARC break my email?
Not at p=none, which only monitors. It can break mail at quarantine or reject if a legitimate service is not authenticated, which is exactly why you start at none with a reports address and read the reports before tightening. Newsletters, invoicing, helpdesks and payroll are the usual ones to catch.
What are the rua and ruf addresses?
rua receives the daily aggregate reports, a summary of who sent as your domain and whether they passed. ruf receives per-message failure reports. Aggregate (rua) is the one you actually need; set it and read it for a few weeks before moving past p=none.