邮件身份验证
DMARC 策略生成器
Build a DMARC policy to block spoofed mail and receive authentication reports, or paste an existing DNS record to review its rules in plain English.
什么是 DMARC？
DMARC (Domain-based Message Authentication, Reporting & Conformance) is a DNS record that tells mailbox providers how to handle email that claims to come from your domain without passing authentication. Publishing a policy helps stop attackers from sending spoofed phishing emails to your customers.
Standard SMTP allows senders to put arbitrary addresses in the From header. SPF and DKIM let receiving servers verify whether a message came from an authorized server and carried a valid signature. DMARC links both standards to your visible From domain, sets the enforcement rule for failures, and directs receivers where to send aggregate authentication reports.
SPF
Lists the mail servers and sending platforms authorized to deliver email on behalf of your domain.
DKIM
Adds a cryptographic signature to outgoing messages so receivers can verify the sender domain and confirm the content stayed intact.
DMARC
Checks that SPF or DKIM aligns with your From domain, enforces quarantine or rejection when checks fail, and routes aggregate reports to your team.
Publish the generated value as a TXT record at _dmarc.yourdomain.com with your DNS provider. Once DNS propagation completes, participating mailbox providers begin sending aggregate reports on their daily schedule.
构建您的策略
Choose your enforcement level, alignment rules, and reporting address on the left as the DNS record updates on the right. You can also paste an existing DMARC record into the output box to populate the controls and review your current setup.
策略向导
选择您需要的选项，记录会实时更新。
强制执行
p最关键的一项：当邮件未通过验证却声称来自您的域名时，您希望其他邮件提供商如何处理这类邮件。
仅监控模式。接收方仍会正常投递未通过验证的邮件，但会向您发送报告。这是最安全的起步方式：先观察几周，再逐步收紧策略。
按比例应用
pct一道安全阀：让接收方一开始只对一部分邮件（随机抽取）应用您的策略，这样万一出错也不会一次影响到所有人。大多数人会将其保持在 100%。
子域名策略
sp为 news.yourdomain.com 或 mail.yourdomain.com 等子域名设置单独的规则。若不设置，它们将直接沿用上面的主策略。
不存在的子域名
np专为您从未配置过的子域名设置的更严格规则。骗子偏爱利用这些子域名，因为不存在真实邮件被误拦的风险，所以在此处选择拒绝通常是安全的。
DKIM 对齐
adkimDKIM 签名的域名必须与您的 From 地址匹配到何种程度。宽松模式将子域名（mail.yourdomain.com）视为与 yourdomain.com 匹配；严格模式则要求完全一致。通常选择宽松模式。
SPF 对齐
aspf对 SPF 而言同理：发送服务器的域名必须与您的 From 地址匹配到何种程度。宽松模式允许子域名匹配；严格模式则要求完全一致。通常选择宽松模式。
汇总报告
rua用于接收每日汇总报告的邮箱地址。这些报告会显示谁在以您的域名发送邮件，以及验证是否通过——这正是从 None 策略开始的意义所在。强烈建议填写。
失败报告
ruf用于接收关于单封失败邮件的详细报告的地址。对调试很有帮助，但出于隐私原因，大多数提供商已不再发送此类报告，因此为可选项。
报告间隔
ri您希望多久收到一次汇总报告。实际上，无论如何设置，接收方几乎总是每天发送一次，因此默认值（86400 seconds = 24 hours）保持不变即可。
DNS 记录
请在您的域名下发布此 TXT 记录。
在您的 DNS 提供商处添加一条新记录。"Type" 和 "Host" 是需要填写的字段。某些提供商只需在 host 字段中输入 _dmarc，会自动为您补全域名。
在此粘贴现有记录，向导会自动更新以与之匹配。