DMARC record generator
Answer a few questions and get the TXT record to publish at _dmarc.yourdomain. Everything runs in your browser.
_dmarc.yourdomainv=DMARC1; p=none
- No report address: you will not see who sends as your domain, so you cannot tell when it is safe to tighten the policy.
- p=none only monitors. Read the reports for 2–4 weeks, fix the senders that fail, then move to quarantine and reject.
A safe path to p=reject
- Publish SPF and turn on DKIM for every service that sends as your domain (Microsoft 365, newsletters, ticketing, invoicing).
- Start with p=none and a report address. Read the reports for 2–4 weeks and fix every legitimate sender that fails.
- Move to p=quarantine, optionally with pct=25 first, and watch the reports for complaints.
- Finish with p=reject at 100%. Keep the reports on to catch new senders.
What each tag means
Policy (p=)
What receivers do with mail that fails DMARC: deliver it anyway (none), put it in spam (quarantine) or refuse it (reject). Only quarantine and reject protect the domain; none is for the first weeks while you read the reports.
Subdomain policy (sp=)
The policy for subdomains that have no DMARC record of their own. Leave it equal to p= unless subdomains send mail through other services that are not aligned yet.
Aggregate reports (rua=)
Daily XML reports from receivers listing every server that sent mail as your domain and whether it passed. Without them you cannot tell when it is safe to move to reject. A report address on another domain must authorise it with a DNS record.
Alignment (adkim=, aspf=)
Relaxed (default) lets a subdomain such as mail.example.com count as example.com; strict needs an exact match. Relaxed is right for almost everyone.
Percentage (pct=)
Applies the policy to only part of the failing mail while you roll out quarantine or reject. It is being phased out in the next DMARC version, so treat it as a short-lived step.
Forensic reports (ruf=)
Per-message failure reports. Few large receivers send them because they may contain personal data, so most domains leave them out.
Go further
- Email domain checkerCheck SPF, DKIM and DMARC for any domain in seconds, with what to fix.
- SPF record generatorPick the services that send your mail and get one valid SPF record.
- Microsoft 365 tenant lookupFind the tenant ID behind any domain, its region, cloud and sign-in type.
- All free tools6 no-login helpers for admins
Every domain in your tenant, checked
ConfigCobra's Microsoft 365 inventory lists domains without DKIM / DMARC next to the CIS Microsoft 365 checks, read-only.