Relaxed vs strict alignment?

Relaxed (the default) matches the organizational domain — mail from `news.example.com` aligns with `example.com`. Strict requires an exact domain match. Use strict only if you understand exactly which subdomains send what.

Do I really need rua?

If you ever plan to enforce (`quarantine` or `reject`), yes. Aggregate reports are the only way to find out which legitimate senders are failing alignment before your enforcement starts dropping their mail.

DMARC Record Builder

Builds the TXT record that closes the loop on email authentication: SPF and DKIM say a message is signed; DMARC tells receivers what to do when neither passes. The tool walks you from monitor-only (`p=none`) to quarantine to outright reject, and exposes the alignment modes and percentage rollout that production deployments lean on. Warnings remind you about the common gotchas — going to `p=reject` without an `rua` mailbox to collect failure reports, picking `pct=` below 100% then forgetting to ratchet it up.

—

Presets

Policy (p=)Subdomain policy (sp=)

Percentage to apply policy to (pct=)100% · Receivers apply the policy to this % of failures and treat the rest as p=none.

SPF alignment (aspf=)DKIM alignment (adkim=)

Aggregate report mailbox (rua) (rua=)Forensic report mailbox (ruf, optional) (ruf=)

TXT record · Publish as: _dmarc.example.com

v=DMARC1; p=none; rua=mailto:dmarc@example.com

Publish as a TXT record at _dmarc.<your-domain>. Replace 'example.com' in the rua/ruf addresses with a mailbox you own.

How to use

Start with the monitor preset (`p=none`) — receivers report what's happening without affecting delivery.
Once SPF/DKIM are aligned for all legitimate mail, jump to quarantine (or use `pct=` to slowly ramp).
After a few weeks of clean reports, promote to `p=reject`. Keep the `rua` mailbox forever — it's how you catch new misconfigurations.

Frequently asked questions

Relaxed vs strict alignment?: Relaxed (the default) matches the organizational domain — mail from `news.example.com` aligns with `example.com`. Strict requires an exact domain match. Use strict only if you understand exactly which subdomains send what.
Do I really need rua?: If you ever plan to enforce (`quarantine` or `reject`), yes. Aggregate reports are the only way to find out which legitimate senders are failing alignment before your enforcement starts dropping their mail.

Related tools

SPF Record Builder

Compose a Sender Policy Framework TXT record from mechanisms, IPs and includes — with a live DNS-lookup counter and warnings.

Network 0 0

DKIM Record Builder & Parser

Build or parse a DKIM (DomainKeys Identified Mail) DNS TXT record — paste your public key, pick selector, key type (RSA/Ed25519), hash and flags, get the full record plus the selector._domainkey hostname and a DNS-chunked version for records over 255 chars.

Network 0 0

Email Header Analyzer

Paste a raw email header to walk the Received hops in order, see the per-hop delay, and read off the SPF/DKIM/DMARC verdicts.

Network 0 0

TXT Record Splitter (255-Byte Chunks)

Split a long SPF, DKIM or DMARC TXT record into the 255-byte chunks the DNS protocol requires — outputs BIND, generic zone file, Cloudflare or Route 53 syntax.

Network 0 0

mailto: Link Builder

Build a mailto: URL with To, Cc, Bcc, subject, and body — RFC 6068 percent-encoded, ready to drop into an <a> tag.

Network 0 0

CAA Record Builder (DNS Certificate Authority Authorization)

Generate Certificate Authority Authorization (CAA) DNS records so only the CAs you trust can issue TLS certificates for your domain. Builds BIND-format records and split tag/value rows for control-panel UIs, plus a one-click list of common CAs (Let's Encrypt, DigiCert, Google, Amazon, …).

Network 0 0