DMARC, in plain language
Anyone on the internet can write your domain in the "from" field of an email. SPF and DKIM let receiving servers check whether a sender was allowed to do that. DMARC closes the loop: it tells receivers what to do when the check fails - nothing, send it to spam, or refuse it - and it sends you reports about everyone sending as you, legitimate or not.
Why p=none is the right start
The instinct is to go straight to reject. Resist it. Almost every domain has email flowing from forgotten places: the invoicing tool, the CRM, the support desk, the newsletter platform you tested once. A reject policy turns each of those into silently missing email. p=none changes nothing about delivery but switches on the reports, so a few weeks later you have a list of every real sender to fix first. Then quarantine, then reject - the staircase, not the leap.
Reading the record this tool makes
v=DMARC1 names the version. p= is the policy for your exact domain. rua= is where aggregate reports go. pct= is what share of failing mail the policy applies to - keep 100 unless you are deliberately testing. adkim and aspf control alignment: relaxed lets subdomains pass for the parent domain, strict demands an exact match. Relaxed is what almost everyone should run.
DMARC is not optional anymore
Since 2024, Google and Yahoo require DMARC for anyone sending bulk email, and more providers have followed. Even for small senders it is now table stakes: without a record, spoofed mail from your domain is indistinguishable from your real mail, and some providers quietly distrust you either way.
Frequently asked questions
What is a DMARC record?DMARC is a TXT record published at _dmarc.yourdomain.com that tells mailbox providers how to handle mail that fails SPF or DKIM checks, and where to send reports about who is sending email as your domain. It protects your domain from being spoofed.
Which DMARC policy should I start with?Start with p=none. It changes nothing about delivery but starts the reports, so you can see every legitimate service sending as your domain. Once reports show all real senders passing, move to quarantine, then reject. Jumping straight to reject can silently break email you forgot you send.
What is the rua address in a DMARC record?rua is the email address that receives daily aggregate reports from Gmail, Yahoo and others about mail sent as your domain. Use an address you actually check, or a DMARC report service that turns the XML into something readable.
Does DMARC replace SPF and DKIM?No. DMARC sits on top of SPF and DKIM and tells receivers what to do when those checks fail. You need at least one of them working before DMARC means anything - ideally both.
Is this DMARC generator free?Yes. It is free, needs no account, and runs entirely in your browser.