uCheckeruChecker

DMARC Record Generator

Fill in the fields and we will assemble a valid record, explaining what each tag does. Default values are left out of the record — it comes out shorter, with fewer places to make a typo.

Policy for the domain

Start with none. After two to four weeks, once reports show all your own mail passes, tighten it.

Policy for subdomains
Where to send aggregate reports (rua)

The main benefit of DMARC. Without this address you never learn who sends mail as your domain. If it lives on another domain, that domain must authorise the reports with its own record.

Forensic failure reports (ruf)
Share of mail under the policy

Below 100 only makes sense while phasing in a strict policy.

Reporting interval, seconds

86400 means once a day, which is the standard value.

Identifier alignment

relaxed is the default and suits almost everyone. strict stops subdomains from authenticating mail for the parent domain.

Generated record

v=DMARC1; p=none
How to publish it
TypeNameTTL
TXT_dmarc3600

Three stages of rollout

  1. p=none. Delivery is unchanged, reports accumulate. Usually held for two to four weeks.
  2. p=quarantine. Failing mail goes to spam. Enable once no legitimate senders appear as failing in the reports.
  3. p=reject. Failing mail is rejected outright. The end goal, and what Gmail and Yahoo expect from bulk senders.

Where to publish it

As a TXT record at _dmarc.yourdomain. Most panels only need _dmarc in the name field and append the domain themselves. The leading underscore is mandatory and is the most common typo.

A record on the organisational domain also covers subdomains that have none of their own. A subdomain needs its own record only when it needs a different policy.

What DMARC does not do

It does not inspect message content, and it does not protect against look-alike domains. Against examp1e.com instead of example.com DMARC is powerless — that is a different domain, and your policy does not apply to it. It also does nothing without SPF or DKIM in place, since there would be nothing to align against.

Questions

Nearby

Clean the list before tightening the policy

A strict DMARC policy damages domain reputation when campaigns go to dead addresses and spam traps. uChecker verifies your list before you send — the first 100 addresses are free.

Check your list