Generate and validate DMARC (Domain-based Message Authentication, Reporting & Conformance) records.
Our tools are designed to be intuitive, but if you need assistance, we're here to help.
Professional-grade email and DNS diagnostic tools trusted by IT professionals worldwide.
Generate and validate DMARC (Domain-based Message Authentication, Reporting & Conformance) records.
Percentage of emails to which the DMARC policy applies
Daily aggregate reports of DMARC results
Individual failure reports (may contain sensitive data)
Understanding DMARC records and email authentication
This page provides original, human-reviewed information about generating DMARC records, walking through policy choices, rua/ruf reporting addresses, and the recommended path from none to reject.
DMARC (Domain-based Message Authentication, Reporting, and Conformance) is an email authentication protocol that builds upon SPF and DKIM to provide domain owners with the ability to protect their domain from unauthorized use.
Specifies how to handle emails that fail DMARC authentication:
p=none - Monitor only, no action taken (recommended for initial deployment)p=quarantine - Move suspicious emails to spam/junk folderp=reject - Reject emails that fail authenticationOptional policy for subdomains, same values as main policy:
sp=none - Monitor subdomainssp=quarantine - Quarantine subdomain emailssp=reject - Reject subdomain emailsPercentage of emails to apply the policy to (1-100):
pct=25 - Apply policy to 25% of emailspct=100 - Apply policy to all emails (default)How strictly to check domain alignment:
aspf=r - Relaxed SPF alignment (default, allows subdomains)aspf=s - Strict SPF alignment (exact domain match)adkim=r - Relaxed DKIM alignment (default)adkim=s - Strict DKIM alignmentEmail addresses to receive DMARC reports:
rua=mailto:dmarc@example.com - Aggregate reports (daily summaries)ruf=mailto:forensic@example.com - Forensic reports (individual failures)v=DMARC1; p=none; rua=mailto:dmarc@example.comStart with this to monitor without affecting email delivery
v=DMARC1; p=quarantine; pct=25; rua=mailto:dmarc@example.com; ruf=mailto:forensic@example.comQuarantine 25% of failing emails while monitoring
v=DMARC1; p=reject; sp=reject; aspf=s; adkim=s; rua=mailto:dmarc@example.comMaximum protection with strict alignment for domain and subdomains
v=DMARC1; p=none; rua=mailto:dmarc@example.com; ruf=mailto:dmarc@example.com; fo=1Check that both SPF and DKIM are properly aligned and passing authentication.
Ensure your DMARC record is correctly configured and published.
Review DMARC reports to identify authentication issues.
DMARC records typically propagate within a few hours, but it may take 24-48 hours for all email providers to recognize the changes. Reports usually start arriving within 24 hours.
No, always start with p=none to monitor authentication without affecting email delivery. Gradually move to p=quarantine and then p=reject after analyzing reports and fixing issues.
RUA (Reporting URI for Aggregate reports) provides daily summary reports, while RUF (Reporting URI for Forensic reports) provides detailed failure reports for individual messages.
No, DMARC requires at least one of SPF or DKIM to be configured and passing. For best results, implement both SPF and DKIM before deploying DMARC.
DMARC reports are in XML format and can be complex. Use DMARC analysis tools or services to parse and visualize the data, identifying authentication failures and potential threats.
Our tools are designed to be intuitive, but if you need assistance, we're here to help.
Professional-grade email and DNS diagnostic tools trusted by IT professionals worldwide.