Build a DMARC TXT record with 3-stage rollout presets (monitoring → quarantine → reject), parse an existing record, or paste an aggregate XML report to see source IPs, alignment results, and failing senders. Includes full tag reference, migration timeline, common mistakes, and shareable URL state.
Pick a stage and customise. The record updates live.
_dmarc.<domain>) — it is never sent anywhere.
Publish as a TXT record at _dmarc.yourdomain.com.
v=DMARC1; p=none
_dmarc.yourdomain.com. IN TXT "v=DMARC1; p=none"
TXT record at the _dmarc subdomain (host = _dmarc).dig +short TXT _dmarc.yourdomain.com.
Paste a v=DMARC1 string from your DNS or dig output.
Paste a DMARC record to see its tags and any issues.
| Tag | Value | What it does |
|---|
gunzip report.xml.gz on Linux/macOS, or 7-Zip on Windows), then paste the XML below.
Standard RFC 7489 XML schema. Parsed entirely in your browser.
Paste a report XML to see source IPs, alignment results, and failing senders.
| Source IP | Volume | Disposition | SPF | DKIM | Alignment |
|---|
Why DMARC, and how it sits on top of SPF and DKIM.
SPF verifies the envelope sender (the Return-Path). The end user never sees it.
DKIM cryptographically signs the message body and selected headers, so receivers can verify nothing was tampered with in transit.
Neither protects the visible From: header. Spoofers exploit that gap.
DMARC closes it. It tells receivers: "Reject mail unless either SPF or DKIM passes and the verified domain matches the visible From: domain."
Plus, DMARC asks receivers to send daily aggregate reports — your visibility into who is sending mail "from" your domain.
Don't jump straight to p=reject.
p=none with rua=. Read reports.p=quarantine; pct=10. Watch reports daily.p=reject; pct=10, then ramp to 100.All tags defined by RFC 7489.
| Tag | Required | Default | Meaning |
|---|---|---|---|
v | yes | DMARC1 | Protocol version. Must be exactly DMARC1. |
p | yes | — | Policy: none, quarantine, or reject. |
sp | no | = p | Policy for subdomains. |
pct | no | 100 | Percentage of failing mail to apply the policy to. |
rua | no | — | Aggregate report destination(s), comma-separated mailto: URIs. |
ruf | no | — | Forensic report destination(s). Most receivers no longer send these. |
adkim | no | r | DKIM alignment: relaxed (subdomain matches) or strict (exact). |
aspf | no | r | SPF alignment, same values as adkim. |
fo | no | 0 | Failure reporting options: 0, 1, d, s. |
ri | no | 86400 | Reporting interval in seconds. |
Top 5 in production deployments.
p=reject
Without first running p=none and reading reports for weeks, you will reject legitimate mail you forgot about (CRM, billing, monitoring).
rua= tag
DMARC without aggregate reporting is half-blind. You publish a policy and have no idea who's sending as you. Always set rua=.
_dmarc.yourdomain.com, not yourdomain.com. Many DNS UIs require entering host as _dmarc only — a frequent fat-finger error.
sp= isn't set, subdomains inherit p=. If your subdomains have their own SPF/DKIM, this might not be what you want — set sp= explicitly.
em.yourdomain.com. With adkim=s (strict), that DKIM domain doesn't match yourdomain.com in From: → DMARC fails. Use relaxed unless you specifically need strict.