DMARC Record Builder

DMARC is the record that closes the loop on email authentication. SPF and DKIM each say something about a message; DMARC says what a receiver should do when neither of them lines up with the address the reader actually sees, and where to send reports about it. The builder walks the usual path — monitor with p=none, then p=quarantine, then p=reject — and exposes the alignment modes, the subdomain policy and the percentage rollout that real deployments lean on. The record is published as TXT at _dmarc.yourdomain.

Alignment is the idea that makes DMARC worth having, and it is the part that is easiest to miss. SPF authenticates the envelope sender and DKIM authenticates whatever domain signed the message, and neither is necessarily the From: address a person reads. DMARC requires one of them to match that visible domain: relaxed mode accepts any subdomain of the organisational domain, strict mode demands an exact match. This is why mail sent through a provider can pass SPF, pass DKIM, and still fail DMARC — the provider's own bounce domain is what SPF authenticated, and that is not your domain.

Start at p=none and mean it. That policy changes nothing about delivery; all it does is turn on the aggregate reports that tell you who is sending as you, which is the information you need before tightening anything. Publish an rua address from the first day, because a record with a policy and no reporting address gives you enforcement with no visibility. If that address is at a different domain, the receiving domain has to authorise it with its own DNS record — yourdomain.com._report._dmarc.theirdomain.com — and reports silently stop arriving when it is missing. ruf failure reports are a different matter: most large receivers do not send them at all, for privacy reasons, so an empty ruf mailbox is normal rather than a misconfiguration.

Two practical notes. pct= samples enforcement rather than weakening it, so pct=10 with p=reject rejects a tenth of failing mail and quarantines the rest — it is a ratchet to turn, not a setting to leave. And since early 2024, Google and Yahoo have required bulk senders to publish a DMARC record at all, so for a domain that sends any volume this is no longer optional hygiene.