---
title: "DMARC record generator"
description: "Read the DMARC record a domain publishes today, then build the next one. Every tag explained, the record you can copy, and the rollout that gets you to p=reject without dropping real mail."
url: "https://openemail.uk/tools/dmarc"
---

Tools

# Your DMARC record, and the one to publish next.

Read what a domain publishes today, then build the record that moves it forward. Every tag explained, nothing invented, and a warning wherever a choice would quietly break real mail.

## Build the record

Policy

Receivers change nothing and just send you reports. Forged mail still arrives. This is a measuring position, not a protection.

Subdomain policy

Left to inherit, subdomains follow the policy above. Set it weaker and mail.yourdomain.com becomes the way in.

Aggregate reports go to

A daily XML summary of everything sent in your name. Any mailbox on your own domain will do; separate several addresses with commas.

Forensic reports go to (optional)

Copies of individual failures. Most receivers never send them, and those that do may include message content. Leave it empty unless you know you want it.

DKIM alignment

Relaxed lets a subdomain sign. Strict demands the exact domain.

SPF alignment

Strict here is what breaks most third-party senders.

The record to publish

Type`TXT`

Name`_dmarc`

Value`v=DMARC1; p=none;`

Most registrars want `_dmarc` alone in the name field and append the domain for you. A few want the whole thing. If you end up with a record at `_dmarc.yourdomain.com.yourdomain.com`, that is which one yours is.

- No aggregate report address. You will not find out what this policy breaks until somebody tells you their mail never arrived.

What to do after publishing

Publish this, then leave it alone for two to four weeks. The aggregate reports will name every service sending as your domain. Fix the ones failing that should not be, then come back and move to quarantine.

## Every DMARC tag

## Questions this raises

What is a DMARC record? A TXT record at \_dmarc.yourdomain.com that tells receiving mail servers what to do when a message claiming to be from you fails SPF and DKIM. SPF and DKIM decide whether a message authenticates; DMARC is the only part that says what should happen when it does not. What does p=none actually do? Nothing to the mail. It asks receivers to treat failing messages exactly as they would have anyway, and to send you a daily report of what they saw. That report is the point. It shows every service sending as your domain, including the ones nobody remembers setting up. p=none is where you start and it is not where you stop. Where do I put the DMARC record? As a TXT record on the host \_dmarc. Most registrars want just \_dmarc in the name field and add your domain automatically; a few want the full \_dmarc.yourdomain.com. If you end up with a record at \_dmarc.yourdomain.com.yourdomain.com, that is the one to fix. Should I go straight to p=reject? Only if you already know every system that sends as your domain, and almost nobody does. Invoicing tools, help desks, marketing platforms and recruiting software all send as you and are all easy to forget. Run p=none with a rua address for two to four weeks, read the reports, fix what fails, then move up. Do I need a rua address? In practice yes. Without it nothing reports back, so you have no way of knowing whether tightening the policy will break real mail. It can be an ordinary mailbox on your own domain. The reports arrive as compressed XML attachments, and any DMARC report reader will make them legible. What does pct do? It applies the policy to a percentage of failing mail and delivers the rest normally, so you can move to quarantine at 10% and watch what happens rather than at 100% and find out. It has no effect with p=none, and leaving it below 100 permanently means most forged mail is still getting through.

OpenEmail generates this record for you.

Add a domain and you get the exact MX, SPF and signing records to publish, checked from the settings screen until they resolve. The DMARC record is generated alongside them and deliberately left for you to publish. It is a policy about mail you send, and nobody should choose p=reject on your behalf.

[Set up a domain](https://openemail.uk/signup.md)

[Check the whole domain](https://openemail.uk/tools/deliverability.md)[How OpenEmail checks senders](https://openemail.uk/features.md#safety)[All tools](https://openemail.uk/tools.md)