How to use the dmarc record builder and parser
- Choose Build a record, then pick a policy: none to only collect reports, quarantine to treat failures as suspicious, or reject to refuse them.
- Add the percentage, report addresses and any alignment settings. Defaults are left out of the record unless you ask for them.
- Copy the TXT value and publish it at the host name shown, which starts with _dmarc.
- To check an existing record, choose Read a record, paste the value and read each tag, its meaning and any problem listed.
Formula
record = v=DMARC1; p=<policy>; [sp=<policy>]; [pct=<0 to 100>]; [rua=mailto:...]; [ruf=mailto:...]; [adkim=r or s]; [aspf=r or s]; [fo=...]; [ri=<seconds>]
defaults when a tag is left out: pct 100, adkim r, aspf r, fo 0, ri 86400, sp same as p
A DMARC record is a list of tag=value pairs separated by semicolons. The version tag comes first and the policy tag comes next, then the optional tags in any order.
A cautious first record and a stricter one
A report only record is v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com. It asks receivers to send daily summary reports to that address and to take no action on failing mail, which is a safe way to learn what is sending mail as your domain.
Later you can move to v=DMARC1; p=quarantine; pct=50; rua=mailto:dmarc-reports@example.com; adkim=s. This applies the quarantine policy to half of the failing mail and requires the DKIM domain to match the From domain exactly. The page checks that this record parses back to the same tags.
Rolling out a policy in steps
Start with p=none and read the reports, so you can see every system that sends mail for your domain. Fix the ones that fail, then raise the policy to quarantine with a low pct and raise the percentage over time before you move to reject.
The page checks the syntax of what you write. It does not test your mail, so a record that is valid can still block legitimate messages if a sender has not been set up.
What the checker flags
The reading mode reports a missing or misplaced version tag, a missing policy, a policy that is not none, quarantine or reject, a percentage outside 0 to 100, report addresses that are not in the mailto: form, repeated tags and tags it does not know. It also notes a pct that has no effect with a none policy.
Check the SPF record that DMARC alignment depends on with the SPF Record Parser, and read a real message with the Email Header Analyzer.
Assumptions and limits
- The syntax follows RFC 7489. Tags np, psd and t come from a newer revision and some receivers do not read them.
- Report addresses must be email addresses in the mailto: form, with an optional size limit after an exclamation mark when reading.
- The page makes no DNS queries and does not know whether a record is published.
- Publishing the record, and the host name it goes at, are done in your DNS service.
- Nothing typed here leaves your browser.
Frequently asked questions
What is the difference between none, quarantine and reject?
None only asks for reports. Quarantine asks receivers to treat failing mail as suspicious, often by sending it to a spam folder. Reject asks receivers to refuse it during delivery.
What does pct do?
It says what share of failing mail the policy applies to. A value of 50 applies the policy to half of it and treats the rest one step more leniently, which lets you ease in a stricter policy.
Why is p required to come second?
RFC 7489 places the policy tag right after the version tag, and some receivers ignore a record where the order is different. The checker warns about it so you can reorder the tags.
Are failure reports (ruf) widely sent?
Many receivers do not send them, because they can contain parts of messages. Treat the ruf tag as optional and rely on the aggregate reports from rua.