The road to p=reject
DMARC tells receivers what to do with mail that passes neither SPF nor DKIM. Starting with p=reject right away loses legitimate mail from services you have not covered yet. The safe path: p=none with a reporting address, four to eight weeks of reading reports and fixing SPF and DKIM for every sender, then p=quarantine, initially with pct=25 if you like, finally p=reject with pct=100.
The tags explained
The generator only sets the tags you chose and leaves defaults out:
- p: policy for the domain, none, quarantine or reject. Required.
- sp: policy for subdomains if it should differ. Without sp, p applies to subdomains as well.
- pct: share of messages quarantine or reject is applied to. For the rollout, 100 at the end.
- rua: address for aggregate reports (XML, once a day per receiver). Without rua you never see who sends on behalf of the domain.
- ruf: address for forensic per-message reports. No longer supported by most large receivers, optional.
- adkim and aspf: alignment relaxed (r) or strict (s). relaxed allows subdomains, strict demands the exact sender domain.
Reports to another domain
If rua points to an address in another domain, such as a report service, that domain must allow receiving: a TXT record at your-domain.com._report._dmarc.other-domain.com with the value v=DMARC1. Report services create this record themselves and tell you the exact address.
Publish and check
Publish the value as a TXT record under the name _dmarc (at some hosts _dmarc.your-domain.com). Exactly one DMARC record per domain. Then use the DMARC checker to confirm the record is found and the policy reads as intended.
Frequently asked questions
- Do I need SPF and DKIM first?
- At least one of them must align with the sender domain, otherwise every message fails DMARC. Both are recommended because SPF breaks on forwarding.
- Can I list several rua addresses?
- Yes, separated by commas, each with mailto:. The generator handles the separation.
- What happens at p=none?
- Nothing changes for delivery, you only receive reports. That makes p=none the starting point, not a permanent state.