DMARC Record Generator

What Is DMARC and Why Do You Need It?

DMARC (Domain-based Message Authentication, Reporting, and Conformance) is the third pillar of email authentication, building on top of SPF and DKIM. It tells receiving mail servers what to do when a message fails authentication checks, and where to send reports about those failures. Without DMARC, having SPF and DKIM in place is necessary but not sufficient — an attacker can still forge your visible From address even if SPF and DKIM pass on a different domain.

Gmail, Yahoo, and Microsoft have all made DMARC a requirement for bulk senders. Domains without a DMARC policy face increased spam filtering and reduced inbox placement across major mailbox providers.

The Three DMARC Policy Levels

DMARC uses a graduated rollout approach with three policy levels. The recommended sequence is to start at none, move to quarantine, and ultimately reach reject.

• p=none — Monitor only. Failing messages are delivered normally, but aggregate reports are sent to the rua address. Use this to discover all your sending sources before enforcing policy.
• p=quarantine — Failing messages go to the spam folder. Use this once you have verified your legitimate mail passes authentication.
• p=reject — Failing messages are rejected outright. This is the strongest protection and the goal for most domains.

Understanding DMARC Alignment

DMARC passes when either SPF or DKIM passes and the authenticated domain aligns with the From header domain. Relaxed alignment (r) allows subdomain matches — for example, mail.example.com aligns with example.com. Strict alignment (s) requires an exact domain match. Start with relaxed alignment and only tighten to strict if you have a specific reason.

DMARC Reporting: rua vs ruf

The rua tag specifies the email address to receive aggregate reports — daily XML summaries of authentication results from all senders worldwide. These are essential for understanding your sending footprint and catching unauthorized senders. The ruf tag specifies the address for forensic (failure) reports, which contain details of individual failing messages. Forensic reports are less widely supported and may contain message content, so they require more careful handling.

You can receive reports at any email address — even one on a different domain. Some organizations use dedicated DMARC report processing services to parse and visualize aggregate XML data.

Completing Your Email Authentication Setup

DMARC works best as the final layer on top of SPF and DKIM. Set up SPF to authorize your sending IPs, configure DKIM signing on your mail server or email service provider, and then add a DMARC policy to tie everything together and receive reports.

Authentication protects you from domain abuse. List hygiene protects your sender reputation. Use email verification to remove invalid addresses before every send, or check large lists with bulk email verification. See pricing for verification plans.