A DMARC record, and what each tag in it commits you to.
Start at p=none — it changes nothing for your recipients and starts the reports flowing, which is the thing you need before you can safely enforce anything.
Comma-separate for more than one. This is the tag that makes DMARC useful — a policy with no reporting address tells you nothing.
No reporting address yet? Sign up free and use ours — 2 domains, no card, and the reports are parsed for you.
Forensic samples can include subject lines, and fewer receivers send them at all. Leave this empty unless you are investigating something specific.
v=DMARC1; p=none
_dmarc.yourdomain.com TXT
Only the tags you used.
This list is generated from the record above, not written out by hand, so it can never describe a tag your record does not contain.
Three things this page cannot check for you.
The record is the easy part. Each of these has ended a rollout, and none of them is visible until after you publish.
Whether your senders will survive it
The record cannot know that your invoicing platform signs with its own domain. Only aggregate reports show that, and only after the record is live at p=none.
Whether the address can receive reports
If the rua address is on a different domain, that domain has to publish a record authorizing yours to send it reports. Most people discover this when nothing arrives.
Whether it published correctly
DNS panels silently mangle long TXT values, split them, or append the domain twice. Look the record up from outside after you save it.
Frequently asked questions.
p=none tells receiving mail servers to take no action on messages that fail DMARC and to deliver them as usual, while still sending aggregate reports to the address in your rua= tag. It is the safe starting policy because it changes nothing for your recipients while the reports build a picture of your senders.
p=quarantine asks receivers to route failing mail to spam or a similar folder. p=reject asks them to refuse the message outright. Move to reject only after aggregate reports confirm every legitimate sender is authenticated and aligned.
The record still publishes and applies its policy without an rua= tag, but you get no visibility into who is sending mail as your domain or which senders are failing. Add an rua= address, whether a mailbox you own or a monitoring service, before moving past p=none.
No. The record is assembled entirely in your browser from the options you choose, and nothing about your domain or your choices is sent to a server.
For the full walkthrough, see the DMARC setup guide.
DMARC Report Analyzer
Paste or upload a DMARC aggregate (RUA) report and see total volume, pass/fail rates, and which senders are failing. Runs in your browser.
SPF Record Generator
Build an SPF record to authorize your email senders. Includes common services and DNS lookup counter.
DKIM Key and Record Generator
Generate a DKIM key pair in your browser and get the TXT record to publish. The private key never leaves your device.
MTA-STS Record and Policy Generator
Build the _mta-sts TXT record and the mta-sts.txt policy file together, with MX patterns and max_age checked.
TLS-RPT Record Generator
Build the _smtp._tls record that asks senders to report failed TLS connections, with email and https destinations checked.
SPF Checker
Look up a domain's SPF record, walk every include, and count DNS lookups against the limit of 10.
Domain Checker
Check your domain's email authentication setup. See your SPF, DKIM, DMARC, and MTA-STS configuration.
DMARC Checker
Look up any domain's DMARC record and get every tag explained — policy, alignment, reporting, and coverage.
DKIM Checker
Check a domain's DKIM record by selector. See the key type, size, and each tag, with quick-picks for common providers.
MTA-STS & TLS-RPT Checker
Check a domain's MTA-STS policy record and TLS-RPT reporting — the pair that forces inbound mail over TLS.
BIMI Checker
Look up a domain's BIMI record, preview the logo, and confirm the VMC and DMARC enforcement it requires.
Publish it, then read what comes back.
At p=none nothing changes for your recipients, so publishing is safe. What follows is reading the reports — which is where you find the senders you had forgotten about. Point rua= at a DDMARC address and they are parsed for you from the first one.