DMARC Record Generator

DMARC is the record that turns SPF and DKIM from information into policy. Without it, a receiving server knows your message failed authentication but has no instruction about what to do. With it, you decide — and, more usefully at first, you get reports telling you who is sending mail in your name.

Start with reporting, not enforcement

The strong temptation is to publish a reject policy immediately, because it sounds like the secure choice. It is the wrong first move. Almost every organisation has at least one legitimate sender it has forgotten: an old invoicing tool, an event platform, a form handler, a script on a server someone set up years ago. A reject policy on day one blocks that mail, and the failure is invisible to you and visible only to the recipient. Publish a monitoring policy, read the aggregate reports for a few weeks, and let the data list your senders for you.

Reading the rollout

Once reports show only senders you recognise and all of them authenticating, move to quarantine, optionally applying it to a percentage of mail first. When quarantine is quiet, move to reject. Subdomains deserve their own consideration: a separate subdomain policy lets you enforce strictly on a domain that should never send mail while staying permissive on the one your business uses daily.

Alignment is the detail that trips people

DMARC does not simply ask whether SPF or DKIM passed. It asks whether the domain they authenticated matches the domain in the From address your recipient sees. A platform sending on your behalf under its own domain can pass SPF perfectly and still fail DMARC. Relaxed alignment accepts a matching organisational domain, strict alignment requires an exact match — and the difference explains most confusing report output.

Where the record goes and what to expect

Publish the value as a TXT record at the _dmarc subdomain of the domain you are protecting. Aggregate reports begin arriving within a day or two as XML files, one per receiving provider per day; a report parser makes them readable. Treat DMARC as a project with a beginning and an end, but re-open it whenever a new sending tool is added, because that is when a working configuration quietly stops covering everything.