Email Security13 min read

DMARC Generator: Every Input Explained

A field-by-field walkthrough of the DMARC Record Generator wizard — what each card writes into the record, and how to pick between the options it offers.

The DMARC Record Generator is a four-step wizard, and each step is made of input cards with a What's this? link in the corner. This article is the long-form version of those pop-ups: one section per card, in wizard order, with the same control rendered inline. Where a card offers a choice, select an option in the preview and the explanation for that specific value appears underneath.

text
_dmarc.acme-corp.com. IN TXT "v=DMARC1; p=quarantine; pct=50; rua=mailto:dmarc@acme-corp.com; fo=1; adkim=r; aspf=r; sp=none" │ │ │ │ │ │ │ │ │ │ │ └── Step 4 │ │ │ │ └── Step 4 │ │ │ └── Step 3 │ │ └── Step 3 │ └── Step 2 └── Step 2

Domain

Step 1, and the only genuinely required input besides the policy. It decides which From: domain the record protects and where the record is published.

DomainrequiredWhat's this?
The domain you send mail from. Everything below is published as one TXT record under it.
acme-corp.com
Look up existing
Publishes at _dmarc.acme-corp.com. “Look up existing” fetches the record already published so you can edit it.

Enter the bare domain — acme-corp.com, not _dmarc.acme-corp.com. The wizard adds the _dmarc label itself and shows you the full name it will publish at. Adding the prefix by hand is one of the most common ways to end up with a record at _dmarc._dmarc.acme-corp.com, where nothing will ever look for it.

DMARC is evaluated against the domain in the visible From: header, which is what makes it the anti-spoofing control that SPF and DKIM alone are not. It protects only the exact domain you publish it under, plus its subdomains through inheritance — so each organisational domain you send from needs its own record.

Look up existing queries the live record. When one is found the wizard replaces the paste card below with an offer to prefill every step from it:

Record foundTXT · _dmarc.acme-corp.com
A DMARC record is already published on this domain. Prefill the wizard with it to edit from where you are today.
v=DMARC1; p=none; rua=mailto:dmarc@acme-corp.com; fo=1
Prefill recordFills every step below. Nothing is published until you apply it in DNS yourself.

Parked domains that send no mail deserve a record too, and it can go straight to p=reject — there is no legitimate mail to break.

Already have a record?

The optional paste card on step 1, for editing a record you have not published yet or copying the configuration from another domain you manage.

Already have a record?paste · optionalWhat's this?
Paste a DMARC record from anywhere — another domain, a vendor’s guide, a draft — to prefill the wizard with it.
v=DMARC1; p=quarantine; pct=50; rua=mailto:dmarc@acme-corp.com
Parse & prefill

Parsing sets the policy, the rollout percentage, every rua and ruf address, both alignment modes and the subdomain policy. Tags the wizard does not model are ignored rather than carried over, so read the generated record before publishing if the original contained anything unusual.

Policy for failing mail

Step 2 opens with the tag that determines whether DMARC does anything at all. It tells receivers what to do with a message that claims to be from your domain and fails both SPF and DKIM alignment. Select a policy to see what it means in practice.

Policy for failing mailpWhat's this?
What receivers should do with mail that claims to be from you but fails authentication.
Monitor p=none
Nothing is blocked. Receivers evaluate the message, record the result and send you a report — delivery is exactly as it was before you published. This is the correct starting point for every domain, because the reports are the only reliable way to discover which systems send mail as you. It is not protection, though: a domain sitting at p=none indefinitely is as spoofable as one with no DMARC record at all.
Select an option above to read what it does.
p must be the second tagRFC 7489 requires v=DMARC1 first and p= second. The generator always emits them in that order — worth knowing if you hand-edit the record afterwards, because some receivers ignore a record where another tag has crept in between them.

Rollout percentage

The second card in step 2. pct applies the policy to a random sample of failing mail instead of all of it, which limits the blast radius the first time you enforce.

Rollout percentagepctWhat's this?
Share of failing mail the policy actually applies to. Ramp up slowly.
Start low when moving to quarantine or reject, then raise it as reports confirm your legitimate mail passes. pct is omitted from the record at 100%.
100% of failing mail pct omitted
The full policy applies to every failing message. This is the default, so the tag is left out of the record entirely — a record with no pct tag behaves exactly like pct=100.
pct=0 does not disable enforcementp=reject; pct=0 downgrades every failing message to quarantine — the next policy down — rather than taking no action. If you want no action at all, choose p=none. Note also that pct is deprecated in the draft revision of the DMARC specification, so treat it as a rollout aid and remove it when you reach 100%.

Aggregate reports

Step 3, and the field that makes everything else possible. rua is where receivers send the daily XML summaries listing every IP that sent mail as your domain and whether each one passed SPF and DKIM.

Aggregate reportsruaWhat's this?
Where daily XML summaries are delivered.
dmarc-reports@acme-corp.com
–
dmarc@vendor.example
–
+ Add aggregate address
Without one you get no visibility — treat this as required.

Enter plain email addresses; the wizard writes the mailto: URIs. Several addresses are allowed and are joined with commas, which is how you point at both an internal mailbox and a reporting service at the same time.

This is how you discover forgotten senders — the CRM, the invoicing tool, the ticketing system — before enforcement starts blocking them. Enforcing without reports is enforcing blind: you find out which system you broke when someone complains.

Reports on another domain need permissionIf the address is on a different organisational domain, that domain must publish an authorisation record — acme-corp.com._report._dmarc.vendor.example containing v=DMARC1. Reporting services set this up as part of onboarding; a plain mailbox on a domain you own does not need it.

Forensic reports

The card beside rua. Forensic — or failure — reports are per-message copies sent the moment an individual message fails, including headers and sometimes the body.

Forensic reportsruf · optionalWhat's this?
Where per-message failure copies are delivered.
dmarc-forensics@acme-corp.com
–
+ Add forensic address
Few receivers send them and they may contain personal data — leave empty if unsure.

Two reasons to leave this empty. First, most large receivers stopped sending forensic reports years ago, so the mailbox is usually quiet regardless of what you publish. Second, the reports that do arrive contain real message data including recipient addresses, which carries privacy obligations you may not want to take on for a stream of data you are not reading.

Fill it in when you have a specific investigation and a mailbox appropriate for that data — then take it back out.

Report interval

How often, in seconds, you would like aggregate reports. The wizard offers the three values that are ever used.

Report intervalriWhat's this?
How often aggregate reports are sent. Most receivers honour daily only.

ri is a request, not a requirement. The large providers send daily whatever you ask for, so setting ri=3600 hoping for hourly reports will not produce them. Leave it at daily — the tag is omitted from the record at the default value, which keeps the record shorter for no loss.

Forensic trigger

The last card in step 3 controls when a forensic report is generated. It only has an effect if you set a ruf address above — the wizard shows an amber note when you have not.

Forensic triggerfoWhat's this?
Which failures generate a forensic report. Only matters if you set a ruf address.
Only written to the record once a forensic (ruf) address is set above.
Either fails fo=1
A report whenever either mechanism fails to produce an aligned pass, even if the message still passes DMARC overall. Far more reports, and far more useful — this is what almost everyone wants if they are enabling forensic reporting at all.
Select an option above to read what it does.

DKIM alignment

Step 4 pairs the two alignment tags side by side. adkim controls how closely the domain in the DKIM signature must match the domain in the From: header.

DKIM alignmentadkimWhat's this?
How closely the DKIM signing domain must match your From domain.
SPF alignmentaspfWhat's this?
How closely the SPF envelope domain must match your From domain.
Relaxed r
Any subdomain of the same organisational domain counts as a match — mail signed by or sent from mail.acme-corp.com aligns with acme-corp.com. This is the default and the right answer for nearly every domain, because it already blocks every unrelated domain.
Select relaxed or strict above — both cards take the same two values.

A DKIM signature carries the signing domain in its d= tag. Alignment compares that with the From: domain, because a valid signature from an unrelated domain proves nothing about who the message claims to be from. Relaxed accepts d=mail.acme-corp.com for a message from acme-corp.com; strict does not.

SPF alignment

The same choice for SPF. Here the comparison is between the envelope sender domain — the Return-Path — and the From: domain.

This is where strict alignment breaks things most often. Mailing platforms routinely use their own bounce domain in the Return-Path so they can process bounces, which passes relaxed alignment only if the bounce domain is a subdomain of yours, and fails strict alignment outright. Unless you control every sender end to end, leave both tags relaxed — the generator omits them at the default value, which is also what receivers assume.

text
From: newsletter@acme-corp.com Return-Path: bounces@mail.acme-corp.com # aligns under aspf=r, fails under aspf=s DKIM d= mail.acme-corp.com # aligns under adkim=r, fails under adkim=s

Subdomain policy

The final card. By default every subdomain inherits the policy in p; sp overrides that for subdomains only, leaving the main domain untouched.

Subdomain policyspWhat's this?
An optional separate policy for mail from subdomains.
Subdomains inherit the main policy unless you set this. Publishing an explicit sp=reject stops attackers spoofing subdomains you never use.
Inherit sp omitted
No sp tag is written, so subdomains inherit whatever p says. This is the right default: one record at _dmarc.example.com then protects mail.example.com, news.example.com and every other subdomain beneath it.
Select an option above to read what it does.

A record published directly at _dmarc.news.example.com takes precedence over the parent record for that subdomain, which is the more granular alternative when one subdomain needs genuinely different reporting rather than just a different policy.

What the wizard does with your answers

Pressing Generate record emits the tags in specification order, drops every tag that is already at its default, and runs the result through a checklist covering policy strength, reporting coverage, alignment choices and the privacy implications of ruf. The result panel shows the DNS fields to enter — host _dmarc, type TXT, the generated value — plus an enforcement-stage read-out of where the record sits on the path from monitoring to reject.

Nothing is published for you. Copy the record into your DNS provider, then confirm it with the DMARC Lookup tool once the TTL has passed.

Frequently Asked Questions

1. Which fields are required?

Technically the domain and the policy. Practically, add at least one rua address — a record of v=DMARC1; p=none with no reporting tells you nothing and protects nothing.

2. Can I go straight to p=reject?

You can, and for a parked domain that sends no mail you should. For a sending domain it is a gamble: any legitimate stream you have forgotten stops being delivered the moment the record goes live. Start at none, read the reports, then move up.

3. Why did my tag disappear from the generated record?

Tags at their default value are omitted deliberately — pct=100, ri=86400, adkim=r and aspf=r all mean exactly the same thing whether present or absent. A shorter record is easier to read and impossible to get wrong.

4. Do I need SPF and DKIM working first?

Yes. DMARC has nothing to evaluate on its own — it reads the SPF and DKIM results and checks their alignment. Publish a record at p=none early to start collecting reports, but do not enforce until those reports show your legitimate mail passing at least one of the two with alignment.

5. What happens to the fo tag if I leave ruf empty?

It is left out of the record. fo only controls when forensic reports are generated, so writing it without a destination address would be meaningless — the wizard shows an amber note in the card to explain why your selection is not appearing in the output.