How to use it
Start with p=none and a rua address so you receive reports. Once reports show only legitimate senders, generate a p=quarantine record, then p=reject. Publish the value as a TXT record at the host shown. If you already have a record, replace it; domains must have exactly one DMARC record.
DMARC record generator: questions
What should my first DMARC record be?+
v=DMARC1; p=none; rua=mailto:[email protected], published as a TXT record at _dmarc.example.com. p=none changes nothing for delivery while the aggregate reports sent to rua= show every source sending as your domain. Fix the legitimate sources that fail, then move to p=quarantine and finally p=reject.
Where do I add the DMARC record in DNS?+
As a TXT record named _dmarc under your domain, so its full name is _dmarc.example.com. In DNS panels that append the domain for you, enter only _dmarc as the host; entering _dmarc.example.com there creates _dmarc.example.com.example.com, which receivers never look up. Replace an existing DMARC record rather than adding a second one.
What does pct mean in DMARC?+
pct is the percentage of failing mail the policy applies to, 100 by default. With p=quarantine; pct=25 a quarter of failing messages are quarantined and the rest are handled normally; with p=reject, failing mail not selected for rejection is quarantined instead (RFC 7489 §6.6.4). Raise pct to 100 once reports show your legitimate mail passes.
What do adkim and aspf mean in DMARC?+
They set the alignment mode for DKIM and SPF. r (relaxed, the default) accepts a DKIM or Return-Path domain that shares the From domain's organizational domain, such as mail.example.com for example.com; s (strict) requires exactly the From domain. Strict breaks services that sign or bounce through a subdomain, so most domains keep both relaxed.
Should I add a ruf address to my DMARC record?+
Usually not. ruf= requests failure reports about individual messages, which few receivers send and which can include message headers or content, so they carry privacy risk. The aggregate reports sent to rua= are what show every source sending as your domain. If you do add ruf=, the fo= tag controls when failure reports are generated.
What does fo=1 mean in DMARC?+
It requests a failure report whenever SPF or DKIM fails to produce an aligned pass, instead of only when both fail, which is the default fo=0. fo=d reports any DKIM signature that fails to verify and fo=s any SPF failure, regardless of alignment. fo= matters only when ruf= is set, and receivers decide whether to honour it.