Write a DMARC record that reports before it rejects

Start at p=none, read the reports, then tighten. The builder assembles p/sp/rua/pct tags without you memorizing the syntax.

Tools used in this guide

The job

DMARC layers a policy on SPF and DKIM: none watches, quarantine folders, reject drops. A rua address tells receivers where to send aggregate reports so you can see who is sending as you — legitimately or otherwise.

Policy, reports, alignment

Pick p= and optionally sp= for subdomains, add rua/ruf report addresses (as plain emails — the tool adds mailto:), and set fo/adkim/aspf/pct/ri only if you need them.

Worked example

Policy quarantine with reports to postmaster@example.com produces: v=DMARC1; p=quarantine; rua=mailto:postmaster@example.com; fo=0; adkim=r; aspf=r; pct=100; ri=86400; — publish it as a TXT record at _dmarc.yourdomain.

Scope

pct 1–100, ri 60–86400 s, record capped at 450 characters. Report addresses on a different domain need that domain to opt in with its own DNS record — the tool validates the address shape, not the receiver's consent.