DMARC Policy TXT Record Formatter & Reporting Tool
Generate RFC 7489 compliant DMARC TXT records with custom policy levels, aggregate rua and forensic ruf reporting tags, and DKIM/SPF alignment.
DMARC Record Parameters
Enter your base domain without protocol prefixes or trailing slashes.
Multiple addresses may be separated by commas. “mailto:” prefix is appended automatically.
Generated DNS TXT Record
RFC 7489 CompliantTXT
_dmarc.example.com
p=none
100%
Relaxed
Relaxed
Security Advisory: If you are deploying DMARC for the first time, begin with p=none. Review aggregate RUA telemetry for 2 to 4 weeks to identify legitimate third-party senders (SendGrid, Mailchimp, Zendesk) before graduating to p=quarantine and p=reject.
The Anatomy of RFC 7489: How DMARC Enforces Domain Integrity
Domain-based Message Authentication, Reporting, and Conformance (DMARC) serves as the governance layer across Internet email communication. While SPF verifies sending IP authorization and DKIM guarantees cryptographic message integrity, neither protocol binds those checks directly to the human-readable “From” address shown in email clients. DMARC resolves this architectural gap through identifier alignment.
Identifier Alignment
DMARC verifies that the RFC 5322 From domain matches the domain authenticated by SPF (Return-Path / RFC 5321.MailFrom) and/or the DKIM signature domain (d= tag).
Sender Policy Enforcement
Domain administrators explicitly dictate the disposition of unauthorized emails: passive monitoring (none), spam folder isolation (quarantine), or boundary SMTP rejection (reject).
Telemetry & Aggregate Data
Mail Transfer Agents (MTAs) worldwide parse incoming messages and transmit structured XML telemetry reports daily back to the addresses specified in rua tags.
DMARC Tag Dictionary & Specification Standard
| Tag | Status | Functional Purpose |
|---|---|---|
| v=DMARC1 | Mandatory | Protocol version specification. Must be first tag in the TXT record. |
| p= | Mandatory | Primary policy: none, quarantine, or reject. |
| rua= | Recommended | Comma-separated mailto URIs for receiving aggregate XML reports. |
| ruf= | Optional | Comma-separated mailto URIs for granular forensic failure reports. |
| sp= | Optional | Subdomain policy override. Inherits p tag value if omitted. |
| pct= | Optional | Integer percentage (0–100) of failing messages subject to policy enforcement. |
| adkim= / aspf= | Optional | Alignment mode: relaxed (r, default) or strict (s). |
Comparative Matrix: Email Authentication Protocol Architecture
A robust defensive perimeter against phishing and spoofing requires coordinating SPF, DKIM, and DMARC in unison. Compare how each security standard operates within the email transport pipeline:
| Security Protocol | RFC Standard | Primary Verification Mechanism | DNS Host Target | Vulnerability / Weakness |
|---|---|---|---|---|
| DMARC | RFC 7489 | From Header Identifier Alignment | _dmarc.domain.com | Requires SPF and DKIM configured first |
| SPF (Sender Policy) | RFC 7208 | Envelope Return-Path IP Whitelist | @ (Apex) | Breaks on email forwarding; 10 DNS lookup limit |
| DKIM (DomainKeys) | RFC 6376 | Public-Key Cryptographic Signature | [selector]._domainkey | Does not authenticate visible From address alone |
| BIMI (Brand Indicators) | Draft RFC | Visual VMC SVG Avatar in Inbox | default._bimi | Strict prerequisite: DMARC p=quarantine or reject |
Zero-Downtime Migration: The 5-Stage DMARC Deployment Roadmap
Jumping straight to a strict reject policy risks blocking legitimate transactional emails from CRM platforms, customer support desks, and marketing automation tools. Follow this production-tested rollout plan:
Recommended Deployment Steps
- • Phase 1: Telemetry Collection (p=none): Deploy a monitoring record with a valid
ruainbox. Gather reports for 14 to 30 days to map all corporate sending services. - • Phase 2: Source Remediation: Update SPF records and configure dedicated DKIM custom domain keys for all authorized SaaS providers (Google Workspace, Microsoft 365, Mailgun, HubSpot).
- • Phase 3: Canary Quarantine (p=quarantine; pct=25): Apply quarantine enforcement to a conservative 25% of failing mail. Monitor feedback loops for false positives.
- • Phase 4: Full Quarantine (p=quarantine; pct=100): Protect users by ensuring 100% of unaligned emails route directly to recipient spam folders.
- • Phase 5: Maximum Enforcement (p=reject): Set reject mode. All unauthorized spoofed emails are dropped at the edge, unlocking eligibility for BIMI verified brand logos.
Critical Configuration Hazards
- • Multiple DMARC Records: Publishing more than one TXT record containing
v=DMARC1at the same host invalidates DMARC entirely according to RFC 7489 §6.6.3. - • Missing mailto: Scheme: Omitting
mailto:before the reporting email in the rua/ruf tags causes receiving MTAs to reject telemetry delivery. - • Exceeding SPF 10-Lookup Limits: If your SPF record exceeds 10 DNS lookups, SPF returns PermError, causing DMARC SPF evaluation to fail. Always authenticate DKIM independently.
- • Unmonitored Reporting Inboxes: High-volume domains receive hundreds of XML attachments daily. Route RUA reports to an automated DMARC analysis tool or dedicated processing mailbox.
Frequently Asked Questions (FAQ)
What is a DMARC TXT record and why is it mandatory?
DMARC (Domain-based Message Authentication, Reporting, and Conformance) is an email authentication protocol defined in RFC 7489. It builds on SPF and DKIM to tell receiving mail exchangers how to handle messages that fail authentication. Google and Yahoo enforce mandatory DMARC records for bulk senders to prevent domain spoofing and phishing.
What is the difference between p=none, p=quarantine, and p=reject?
The p tag specifies the receiver policy. “p=none” monitors email flows and delivers unauthenticated messages while generating XML telemetry reports. “p=quarantine” diverts unverified emails to the spam or junk folder. “p=reject” instructs the receiving MTA to drop unauthenticated messages entirely at the SMTP envelope layer.
What is the difference between rua and ruf reporting tags?
The rua tag defines the destination for Aggregate Reports, which are daily XML documents containing aggregate pass/fail statistics across all sending IP addresses. The ruf tag requests Forensic (Failure) Reports, which send real-time redacted copies of individual messages that failed SPF or DKIM alignment.
What is the correct DNS Host or Name for a DMARC record?
A DMARC record must be published as a DNS TXT record under the subdomain ‘_dmarc.yourdomain.com’. In most DNS control panels (such as Cloudflare, Route 53, or GoDaddy), enter ‘_dmarc’ in the Name/Host field.
What is the difference between relaxed (r) and strict (s) alignment?
Relaxed alignment (adkim=r, aspf=r) permits subdomains to match the parent organizational domain in the From header. Strict alignment (adkim=s, aspf=s) requires the d= domain in DKIM or the Return-Path domain in SPF to exactly match the From header domain byte-for-byte.
How does the percentage (pct) tag safeguard email delivery during migration?
The pct tag instructs receiving mail servers to apply the policy (quarantine or reject) to only a fraction of failing messages (e.g., pct=20). The remaining percentage defaults to p=none. This enables organizations to test enforcement safely without risking complete outbound email loss.
Related & Complementary Utilities
Explore more privacy-first client-side web tools.
Meta Tag Generator & Social Preview Inspector
Generate SEO-optimized HTML meta tags, Open Graph properties, and Twitter Cards with live previews for Google, Facebook, & X. 100% client-side & secure.
WHOIS Domain Age Checker & Expiration Auditor
Query live WHOIS registries to inspect domain creation dates, total active age, registrar information, expiration milestones, and trust metrics.
IP Location Lookup & GeoIP Visualizer
Inspect IPv4/IPv6 locations, ASN telemetry, ISP network data, and interactive location maps.