DMARC Record Builder

What this tool is used for

• Publishing a first DMARC record in monitoring mode to see what is being sent as you.
• Moving from monitoring to quarantine or reject once the reports are clean.
• Getting the tag syntax right for a record you write once every few years.
• Adding reporting addresses so the data actually goes somewhere.
• Setting a separate subdomain policy from the organisational one.

Frequently Asked Questions

What does DMARC add on top of SPF and DKIM?

Alignment and a policy. SPF and DKIM each authenticate a domain, but not necessarily the one in the visible From header — DMARC requires that they match it, and then tells receivers what to do when they do not. Without DMARC, passing SPF for an attacker-owned domain says nothing about the From address.

Why start with p=none?

Because it enforces nothing while still generating reports. That is the entire deployment method: publish `p=none` with a `rua` address, read the reports for weeks to find the legitimate senders you had forgotten about, fix their SPF and DKIM, and only then move to quarantine.

What is the difference between relaxed and strict alignment?

Relaxed (`r`, the default) accepts a subdomain — mail from `mail.example.com` aligns with `example.com`. Strict (`s`) requires an exact match. Strict is what you want once every sender is under control; before then it rejects legitimate mail from your own subdomains.

What does the pct tag do?

Applies the policy to a percentage of failing messages, so you can move to `quarantine` at `pct=10` and watch what happens before committing. Note that it only ever applies to messages that FAIL — it is a rollout control, not a sampling rate on your whole mail flow.

Where does the record go in DNS?

A TXT record at `_dmarc.example.com`, not at the domain apex where SPF lives. Exactly one DMARC record per domain — two published simultaneously is treated as none at all, which silently disables the policy you thought was protecting you.

Common errors and gotchas

• Publishing a reject policy immediately, which can silently discard legitimate mail from services you forgot about.
• Setting a policy without a reporting address, so you get the enforcement and none of the visibility.
• Assuming DMARC works without SPF or DKIM aligned, when it is built entirely on top of them.
• Overlooking the subdomain policy, which inherits unless you set it explicitly.
• Forgetting that a forwarded message can break alignment, which is what the reports are for.