DMARC Record Generator
Build a DMARC record from policy, percentage, alignment and report addresses.
İzleme modu: hiçbir e-posta engellenmez, yalnızca rapor toplanır. Başlangıç için doğru seçim.
Raporlar farklı bir alan adına gidiyorsa o alan adında yetkilendirme kaydı gerekir.
- Kayıt adı (host)
_dmarc.example.com- Kayıt türü
- TXT
- TTL
- 3600 (önerilen)
v=DMARC1; p=noneKaydı yayınladıktan sonra en az iki hafta rapor toplayıp tüm meşru göndericilerinizin hizalandığını doğrulayın; ancak ondan sonra quarantine ve reject'e geçin.
What is DMARC Record Generator?
The DMARC Record Generator builds your _dmarc record from policy, subdomain policy, enforcement percentage, alignment strictness and report addresses, explaining what each tag does.
The order matters: start at p=none with a rua address, collect reports for at least two weeks, align every legitimate sender you see via SPF or DKIM, sit at quarantine for a while, and only then move to reject.
Jumping straight to reject without reports is the most common mistake: a forgotten CRM, invoicing system or newsletter tool suddenly starts being blocked, and it's usually a customer complaint that reveals it.
Frequently Asked Questions
9 questionsWhat name do I publish the record under?
As a TXT record at _dmarc.<your-domain>. In most DNS panels you type just _dmarc in the host field and the panel appends the domain. It is not published at the apex.
Why start with p=none?
You need to see who sends mail as you before enforcing anything. p=none blocks nothing but starts the rua reports. Finding a forgotten CRM or invoicing system in those reports is extremely common — you don't want to discover it after switching to reject.
Should I add ruf (forensic reports)?
Usually not. Most large receivers don't send them for privacy reasons, and where they do, the reports can contain message content, which carries data-protection obligations. rua reports are almost always enough for diagnosis.
How do I read the reports?
rua reports arrive as compressed XML and are painful by hand. Free and paid DMARC report analysers turn them into tables. A small domain gets a few per day; a large one can get hundreds.
Will moving to reject cut off my mail?
Only mail from senders that aren't aligned. That's why the order matters: collect reports at p=none, align every legitimate sender via SPF or DKIM, sit at quarantine for a while, and only then move to reject.
What if I send reports to my own mailbox?
You'll get anywhere from a few to hundreds of compressed XML attachments a day, which isn't practical to read by hand. Your own mailbox works for a small domain, but a report analyser (free options exist) turns them into tables and trends.
Will lowering ri get me reports more often?
Not necessarily. ri is a request, not a guarantee; most receivers send one report a day and ignore shorter intervals. Changing the 86400 default is rarely useful.
Should a record have both rua and ruf?
rua is enough. ruf reports can contain message content, which carries data-protection obligations, and most large receivers don't send them anyway.
Do subdomains need their own record?
Usually no — they inherit the parent policy. Publish a separate _dmarc record only when a subdomain must behave differently, such as a marketing subdomain still mid-rollout.