---
title: "DMARC record generator"
description: "Read the DMARC record a domain publishes today, then build the next one. Every tag explained, the record you can copy, and the rollout that gets you to p=reject without dropping real mail."
url: "https://nextmail.sh/tools/dmarc"
---

Tools

# Your DMARC record, and the one to publish next.

Read what a domain publishes today, then build the record that moves it forward. Every tag explained, nothing invented, and a warning wherever a choice would quietly break real mail.

## Build the record

Policy

Receivers change nothing and just send you reports. Forged mail still arrives. This is a measuring position, not a protection.

Subdomain policy

Left to inherit, subdomains follow the policy above. Set it weaker and mail.yourdomain.com becomes the way in.

Aggregate reports go to

A daily XML summary of everything sent in your name. Any mailbox on your own domain will do; separate several addresses with commas.

Forensic reports go to (optional)

Copies of individual failures. Most receivers never send them, and those that do may include message content. Leave it empty unless you know you want it.

DKIM alignment

Relaxed lets a subdomain sign. Strict demands the exact domain.

SPF alignment

Strict here is what breaks most third-party senders.

The record to publish

Type`TXT`

Name`_dmarc`

Value`v=DMARC1; p=none;`

Most registrars want \_dmarc alone in the name field and append the domain for you. A few want the whole thing. If you end up with a record at \_dmarc.yourdomain.com.yourdomain.com, that is which one yours is.

- No aggregate report address. You will not find out what this policy breaks until somebody tells you their mail never arrived.

What to do after publishing

Publish this, then leave it alone for two to four weeks. The aggregate reports will name every service sending as your domain. Fix the ones failing that should not be, then come back and move to quarantine.

## Every DMARC tag

- **`v=` DMARC1**
  The version, and it must be the first tag in the record. A record that does not open with it is ignored.
- **`p=` none · quarantine · reject**
  What receivers should do with mail that fails. The only required tag besides v.
- **`sp=` none · quarantine · reject**
  The policy for subdomains. Left out, subdomains inherit p. Setting it weaker than p is how domains get forged through mail.acme.com.
- **`pct=` 0–100**
  The share of failing mail the policy is applied to. A ramp, not a setting. It does nothing at all with p=none.
- **`rua=` mailto: address**
  Where daily aggregate reports go. Without it you are enforcing blind, so in practice it is required.
- **`ruf=` mailto: address**
  Forensic reports on individual failures. They can carry message content, most receivers never send them, and almost nobody needs them.
- **`adkim=` r · s**
  How closely the DKIM signing domain must match. Relaxed allows subdomains; strict demands the exact domain.
- **`aspf=` r · s**
  The same question for SPF. Strict here breaks most third-party senders.
- **`fo=` 0 · 1 · d · s**
  When to generate a forensic report. Only meaningful alongside ruf.
- **`ri=` seconds**
  How often aggregate reports are wanted. Almost everyone leaves this at the default of 86400 (one day).

## Questions this raises

Nextmail generates this record for you.

Add a domain and you get the exact MX, SPF and signing records to publish, checked from the settings screen until they resolve. The DMARC record is generated alongside them and deliberately left for you to publish. It is a policy about mail you send, and nobody should choose p=reject on your behalf.

[Set up a domain](https://nextmail.sh/signup.md)

[Check the whole domain](https://nextmail.sh/tools/deliverability.md)[How Nextmail checks senders](https://nextmail.sh/features.md#safety)[All tools](https://nextmail.sh/tools.md)