Free email security tool
Choose a policy and where reports should go. You get the exact TXT host and value to publish, and a plain warning when a choice has a consequence you should know about.
Create a TXT record in your DNS zone with the host and value shown above. A domain must publish exactly one DMARC record. After DNS has updated, read it back with the DMARC Checker to confirm receivers can interpret it.
p is the policy receivers apply to mail that fails DMARC: none (deliver and report), quarantine (treat as suspicious, usually spam) or reject (refuse). sp sets a separate policy for subdomains; without it they inherit p. pct applies the policy to part of the failing mail. rua is where aggregate reports go; ruf requests per-message failure reports, which most large receivers no longer send. adkim and aspf choose relaxed or strict alignment between the visible From domain and the DKIM and SPF domains.
It builds a record from what you enter. It does not look at your domain, so it cannot tell you whether a stricter policy would block legitimate mail. That answer comes from aggregate reports.
Add your domain to CloudSpex to receive and read DMARC aggregate reports, see every source sending mail as your domain, and get alerted when the record changes.
Start Monitoring FreeStart with p=none and a rua address. It changes nothing about delivery but makes receivers send you aggregate reports, which show every source sending mail as your domain. Move to quarantine and then reject only after the reports show your legitimate senders pass.
As a TXT record at _dmarc.yourdomain.com. A domain must have exactly one DMARC record; if a second one is published, receivers ignore both.
pct asks receivers to apply the policy to that percentage of failing messages; the rest get the next weaker policy. It is applied per message at random, so it is an expectation, not an exact count.
No. The generator only builds a record from what you enter. To read the record your domain publishes today, use the DMARC Checker.