What is DMARC alignment?

DMARC requires that the domain in the visible From: header aligns with either the SPF return-path domain or the DKIM signing domain. The adkim and aspf tags control whether alignment is relaxed (subdomain matches accepted) or strict (exact match required).

Where does the rua aggregate report go?

To every email address listed in the rua tag. Receivers send daily XML reports describing how many messages claimed to be from your domain, how many passed DMARC, and which sources sent them. A reporting vendor or a parser turns the XML into something humans can read.

Should I set ruf for forensic reports?

It is optional. Forensic reports contain redacted samples of failing messages and may include personal data. Many large receivers do not send forensic reports at all. Most operators run on aggregate reports alone and skip ruf.

What is the recommended DMARC rollout sequence?

Publish SPF and DKIM. Add DMARC at p=none with rua set. Read aggregate reports for two to four weeks and fix legitimate senders that fail alignment. Move to p=quarantine with pct=25, then ramp pct upward. Finish at p=reject with pct=100. Keep aggregate reports flowing throughout.

Where do I publish the DMARC TXT record?

At the host _dmarc.yourdomain.com. The record value is the full DMARC string starting with v=DMARC1. Once DNS propagates, DMARC-aware receivers will start applying the policy and (if rua is set) sending aggregate XML reports.

What does pct do in DMARC?

pct sets the percentage of failing messages the policy is applied to. pct=25 with p=quarantine means 25% of failing messages are quarantined and the rest are treated as p=none. It exists so operators can ramp up policies safely. pct only affects p=quarantine and p=reject.

Free Tool

DMARC Record Generator
build a valid DMARC TXT record

Generate a syntactically correct DMARC TXT record from a guided form. Choose the policy, alignment, percentage, and aggregate report addresses, copy the record, and paste it into DNS. Runs entirely in your browser.

Get Started Free

No credit card required. Free plan available forever.

Your domain

Policy (p)

Subdomain policy (sp)

Percentage (pct)

Aggregate report address (rua)

Comma-separated email addresses. Each one becomes a mailto: entry.

Forensic report address (ruf)

Receivers can send per-message failure samples here. Sensitive content; many receivers do not send these.

DKIM alignment (adkim)

SPF alignment (aspf)

Failure reporting options (fo)

Report interval (ri, seconds)

Generated DMARC record

2 warnings

TXT record host

_dmarc.yourdomain.com

TXT record value

v=DMARC1; p=none

Warning: p=none only monitors. It does not block spoofed mail. Move to p=quarantine then p=reject once aggregate reports look clean.
Warning: No rua address set. Without aggregate reports you cannot see who is sending as your domain or why mail is failing DMARC.

Everything runs in your browser. Nothing is sent to a server.

How to publish a DMARC record

DMARC is published as a single TXT record at the host _dmarc.yourdomain.com. Generate the record above, copy the host and value, then create a TXT record in the DNS zone for your domain. Once DNS propagates, receivers that support DMARC start applying the policy and (if you set rua) sending aggregate XML reports to the address you nominated.

Publish SPF and DKIM for the domain first. DMARC depends on at least one of them passing and being aligned.
Start at p=none to monitor without affecting mail delivery.
Read aggregate reports for at least a couple of weeks. Identify legitimate senders and fix any that fail alignment.
Move to p=quarantine with a small pct (for example 25), then ramp it up.
Once aggregate reports are clean, move to p=reject; pct=100.

DMARC tag reference

Tag	Meaning
v	Protocol version. Always `DMARC1`. Required and must be the first tag.
p	Policy for the organisational domain. `none`, `quarantine`, or `reject`. Required.
sp	Policy for subdomains. Inherits from `p` if omitted. Use a stricter `sp` if subdomains should never send mail.
pct	Percentage of mail subject to the policy. 0 to 100. Default 100. Useful when ramping up to `reject`.
rua	Aggregate report addresses (comma-separated `mailto:` URIs). Receivers send daily XML reports here.
ruf	Forensic report addresses for per-message failure samples. Optional and many receivers do not send these.
adkim	DKIM alignment. `r` (relaxed, default) allows subdomain matches. `s` (strict) requires an exact domain match.
aspf	SPF alignment. Same options as `adkim`, applied to the SPF check.
fo	Failure reporting options. `0` (both fail), `1` (either fails), `d` (DKIM fails), `s` (SPF fails).
rf	Forensic report format. `afrf` (default) is the only widely supported value.
ri	Aggregate report interval in seconds. Default 86400 (24 hours). Most receivers ignore values below 3600.

Common DMARC record examples

Monitoring only

Best place to start. Aggregate reports flow in, but no mail is blocked. No legitimate sender breaks just because DMARC is published.

v=DMARC1; p=none; rua=mailto:dmarc@example.com

Quarantine 25% as a ramp

Quarantine is the middle policy. Use pct=25 to start the ramp once monitoring shows aligned legitimate mail.

v=DMARC1; p=quarantine; pct=25; rua=mailto:dmarc@example.com

Reject everything that fails

The end goal. Spoofed mail claiming to be from your domain is rejected at the receiver. Aggregate reports keep flowing so anomalies are still visible.

v=DMARC1; p=reject; rua=mailto:dmarc@example.com; ruf=mailto:dmarc-forensics@example.com; fo=1

Strict subdomain protection

For domains whose subdomains never send mail, set sp=reject even while the organisational domain is at quarantine. This blocks attacker-invented subdomains.

v=DMARC1; p=quarantine; sp=reject; rua=mailto:dmarc@example.com

Related security resources

DMARC is one piece of a domain's email security posture. These pages cover the rest.

Frequently asked questions

Does DMARC replace SPF and DKIM?

No. DMARC sits on top of SPF and DKIM. It tells receivers what to do when neither passes with alignment. Publish SPF and DKIM first, then add DMARC.

Why should I start at p=none?

p=none publishes a policy without affecting mail delivery. Aggregate reports then show every sender claiming to be your domain, including the ones you have forgotten about. Fix those before tightening the policy.

What is alignment?

DMARC requires that the domain in the visible From: header aligns with either the SPF return-path domain or the DKIM signing domain.adkim=r and aspf=r (relaxed) accept subdomain matches; the strict variant requires an exact match.

Where do aggregate reports go?

To every address listed in rua. The files are XML, sent daily by most large receivers. A reporting vendor or a homegrown parser turns them into something readable.

Can the rua address be on a different domain?

Yes, but receivers will require an authorisation TXT record at your-domain._report._dmarc.reporting-domain before they will deliver reports there. If reports never arrive, that record is the first thing to check.

Should I set ruf?

Optional. Forensic reports contain redacted samples of failing messages, which can include personal data. Many receivers do not send them at all. Most teams run on aggregate reports alone and skip ruf.

Loading tool...

Related features

Vulnerability scanning tools that map your attack surface

Cyber security assessments

Want to verify the record after you publish it?

SecPortal scans DMARC, SPF, DKIM, DNSSEC, subdomains, and 13 more external modules in a single run. Start free.

Get Started Free

No credit card required. Free plan available forever.

How to publish a DMARC record

Publish SPF and DKIM for the domain first. DMARC depends on at least one of them passing and being aligned.

Start at p=none to monitor without affecting mail delivery.

Read aggregate reports for at least a couple of weeks. Identify legitimate senders and fix any that fail alignment.

Move to p=quarantine with a small pct (for example 25), then ramp it up.

Once aggregate reports are clean, move to p=reject; pct=100.

DMARC tag reference

Tag	Meaning
v	Protocol version. Always `DMARC1`. Required and must be the first tag.
p	Policy for the organisational domain. `none`, `quarantine`, or `reject`. Required.
sp	Policy for subdomains. Inherits from `p` if omitted. Use a stricter `sp` if subdomains should never send mail.
pct	Percentage of mail subject to the policy. 0 to 100. Default 100. Useful when ramping up to `reject`.
rua	Aggregate report addresses (comma-separated `mailto:` URIs). Receivers send daily XML reports here.
ruf	Forensic report addresses for per-message failure samples. Optional and many receivers do not send these.
adkim	DKIM alignment. `r` (relaxed, default) allows subdomain matches. `s` (strict) requires an exact domain match.
aspf	SPF alignment. Same options as `adkim`, applied to the SPF check.
fo	Failure reporting options. `0` (both fail), `1` (either fails), `d` (DKIM fails), `s` (SPF fails).
rf	Forensic report format. `afrf` (default) is the only widely supported value.
ri	Aggregate report interval in seconds. Default 86400 (24 hours). Most receivers ignore values below 3600.

Common DMARC record examples

Monitoring only

Best place to start. Aggregate reports flow in, but no mail is blocked. No legitimate sender breaks just because DMARC is published.

v=DMARC1; p=none; rua=mailto:dmarc@example.com

Quarantine 25% as a ramp

Quarantine is the middle policy. Use pct=25 to start the ramp once monitoring shows aligned legitimate mail.

v=DMARC1; p=quarantine; pct=25; rua=mailto:dmarc@example.com

Reject everything that fails

The end goal. Spoofed mail claiming to be from your domain is rejected at the receiver. Aggregate reports keep flowing so anomalies are still visible.

v=DMARC1; p=reject; rua=mailto:dmarc@example.com; ruf=mailto:dmarc-forensics@example.com; fo=1

Strict subdomain protection

For domains whose subdomains never send mail, set sp=reject even while the organisational domain is at quarantine. This blocks attacker-invented subdomains.

v=DMARC1; p=quarantine; sp=reject; rua=mailto:dmarc@example.com

Frequently asked questions

Does DMARC replace SPF and DKIM?

No. DMARC sits on top of SPF and DKIM. It tells receivers what to do when neither passes with alignment. Publish SPF and DKIM first, then add DMARC.

Why should I start at p=none?

What is alignment?

Where do aggregate reports go?

To every address listed in rua. The files are XML, sent daily by most large receivers. A reporting vendor or a homegrown parser turns them into something readable.

DMARC Record Generatorbuild a valid DMARC TXT record

Generated DMARC record

How to publish a DMARC record

DMARC tag reference

Common DMARC record examples

Monitoring only

Quarantine 25% as a ramp

Reject everything that fails

Strict subdomain protection

Related security resources

Frequently asked questions

Does DMARC replace SPF and DKIM?

Why should I start at p=none?

What is alignment?

Where do aggregate reports go?

Can the rua address be on a different domain?

Should I set ruf?

Related features

Vulnerability scanning tools that map your attack surface

Cyber security assessments

Want to verify the record after you publish it?

Generated DMARC record

How to publish a DMARC record

DMARC tag reference

Common DMARC record examples

Monitoring only

Quarantine 25% as a ramp

Reject everything that fails

Strict subdomain protection

Related security resources

Frequently asked questions

Does DMARC replace SPF and DKIM?

Why should I start at p=none?

What is alignment?

Where do aggregate reports go?

Can the rua address be on a different domain?

Should I set ruf?

DMARC Record Generator
build a valid DMARC TXT record