Email authentication
DMARC policy generator
Build a DMARC policy to block spoofed mail and receive authentication reports, or paste an existing DNS record to review its rules in plain English.
What is DMARC?
DMARC (Domain-based Message Authentication, Reporting & Conformance) is a DNS record that tells mailbox providers how to handle email that claims to come from your domain without passing authentication. Publishing a policy helps stop attackers from sending spoofed phishing emails to your customers.
Standard SMTP allows senders to put arbitrary addresses in the From header. SPF and DKIM let receiving servers verify whether a message came from an authorized server and carried a valid signature. DMARC links both standards to your visible From domain, sets the enforcement rule for failures, and directs receivers where to send aggregate authentication reports.
SPF
Lists the mail servers and sending platforms authorized to deliver email on behalf of your domain.
DKIM
Adds a cryptographic signature to outgoing messages so receivers can verify the sender domain and confirm the content stayed intact.
DMARC
Checks that SPF or DKIM aligns with your From domain, enforces quarantine or rejection when checks fail, and routes aggregate reports to your team.
Publish the generated value as a TXT record at _dmarc.yourdomain.com with your DNS provider. Once DNS propagation completes, participating mailbox providers begin sending aggregate reports on their daily schedule.
Build your policy
Choose your enforcement level, alignment rules, and reporting address on the left as the DNS record updates on the right. You can also paste an existing DMARC record into the output box to populate the controls and review your current setup.
Policy wizard
Pick the options you want. The record updates live.
Enforcement
pThe big one: what you're asking other mail providers to do with email that fails the check and claims to be from you.
Monitor only. Receivers still deliver failing mail as normal but send you reports. The safe place to start: you watch for a few weeks before tightening.
Apply to a percentage
pctA safety valve: have receivers apply your policy to only a slice of mail at first (chosen at random), so a mistake can't affect everyone at once. Most people leave this at 100%.
Subdomain policy
spSet a separate rule for subdomains like news.yourdomain.com or mail.yourdomain.com. Leave off and they simply follow the main policy above.
Non-existent subdomains
npA stricter rule just for subdomains you've never set up. Scammers love these because there's no real mail to accidentally block, so reject is usually safe here.
DKIM alignment
adkimHow closely the DKIM signature's domain must match your From address. Relaxed counts a subdomain (mail.yourdomain.com) as a match for yourdomain.com; strict demands an exact match. Relaxed is the usual choice.
SPF alignment
aspfThe same idea for SPF: how closely the sending server's domain must match your From address. Relaxed allows subdomains to match; strict requires an exact match. Relaxed is the usual choice.
Aggregate reports
ruaThe email address that receives the daily summary reports. These show who is sending mail as your domain and whether it's passing, the whole reason to start at None. Strongly recommended.
Failure reports
rufAn address for detailed reports about individual messages that failed. Useful for debugging, but most providers no longer send these for privacy reasons, so it's optional.
Report interval
riHow often you'd like the aggregate reports. In practice receivers almost always send them once a day regardless, so the default (86400 seconds = 24 hours) is fine to leave alone.
DNS record
Publish this TXT record at your domain.
Add this as a new record at your DNS provider. “Type” and “Host” are the fields it asks for. Some providers want just _dmarc in the host field and add the domain for you.
Paste an existing record here and the wizard updates to match.
Put it into practice.
Continue with the documentation, guides and examples for this topic.