DMARC Record Builder

Gmail and Yahoo now require DMARC from bulk senders, and most people land here just wanting to know which string to paste into DNS before the deadline bites. Pick the policy, enter the address that will receive aggregate reports in the rua field, decide on ruf and alignment, and the page hands back the finished value along with the record name, which is _dmarc in front of your domain.

Tag order matters: v=DMARC1 has to come first and p= right after it, which the tool already handles. The pct tag only shows up in the output when you set it to something other than 100, since 100 is the implicit default. There is also a quiet trap: if the rua address lives on another domain, that domain has to authorise it with a TXT record shaped like yourdomain.com._report._dmarc.destination.com. Without it the reports simply never arrive, and nothing warns you.

The safe path is publishing p=none with rua filled in, letting it run for a few weeks and reading the reports, which reveal who is sending mail using your domain. Only then move to quarantine and later reject. Think twice before filling ruf: forensic reports carry fragments of real messages, many providers never send them, and third-party data is involved. This page covers p, pct, rua, ruf, aspf and adkim; tags such as sp, fo, rf and ri you add by hand. Nothing is looked up in DNS.