DMARC record builder, with a dated rollout from p=none to reject

Pick a policy, say where reports should go, and this page writes the TXT record to publish at _dmarc.yourdomain.com, then gives a dated schedule for moving from monitoring to enforcement. It runs entirely in your browser: nothing you type is sent anywhere, and it never touches your DNS.

What each part means

• v=DMARC1 must come first. RFC 7489 says a record that does not start with it is ignored.
• p= is the policy for mail that fails DMARC: none (collect reports, change nothing), quarantine or reject.
• rua=mailto:... is where receivers send daily aggregate (XML) reports. These tell you who really sends as your domain, so you can fix senders before you enforce.
• sp= sets the policy for subdomains. If you leave it out, subdomains follow p=.
• adkim and aspf choose relaxed (r, the default) or strict (s) matching between the visible From domain and the DKIM or SPF domain. Strict breaks mail that is signed or sent from a subdomain, so most domains should leave it relaxed.

Why the rollout is slow on purpose

DMARC passes when SPF or DKIM passes and the domain in that check matches the From address. A sender you forgot (a billing tool, a newsletter service, a helpdesk) fails that test, and under p=reject its mail is refused. So the safe order is: publish p=none with a rua address, read the reports for two to four weeks, fix every legitimate sender that fails, then move to quarantine, wait again, and only then reject. The builder's schedule uses two weeks at none and two weeks at quarantine as a floor. Use longer if your reports still show legitimate mail failing, and shorter never.

Reports sent to a different domain

If the rua address is on another domain than the one you protect (for example a reporting service), RFC 7489 section 7.1 requires that other domain to publish a TXT record at yourdomain.com._report._dmarc.thatdomain.com with the value v=DMARC1, or receivers may not send the reports. Reporting services tell you the exact name; a mailbox on your own domain needs nothing extra.

Check it after you publish

1. Wait for your DNS host to publish the TXT record, then read it back in the free checker, which shows the DMARC policy it finds from live DNS.
2. Make sure there is exactly one DMARC record at _dmarc. Two records make the policy invalid.
3. Send a message to a mailbox you control and look at its Authentication-Results header for dmarc=pass.

Want the whole thing written for your own senders? Mail Auth Fix Sheet ($39, within 24 hours) reads your live DNS and each sender's current setup page, then hands you the exact records and this rollout dated for your domain. If your SPF record is also failing, read SPF too many lookups first.