Where do I start, none or reject?

With p=none and a report address. That level changes nothing about delivery but makes sure you receive aggregate reports and see which systems send in your name. There are almost always services among them that nobody remembered. Only once they all pass SPF or DKIM cleanly do you move to quarantine and then to reject. That path takes weeks, not minutes.

Where exactly do I enter the record?

As a TXT entry on _dmarc.your-domain.com. At most providers you only type _dmarc as the name because the domain is appended automatically; the generator shows the full name to be safe. On the domain itself the record is in the wrong place and is never found.

Do I need SPF and DKIM for DMARC to be useful?

Yes. DMARC checks nothing of its own. It evaluates the results of SPF and DKIM and additionally requires the domain checked there to match the visible sender address. Without at least one of the two, no message passes, and an enforced policy would hit your own mail.

What is the difference between relaxed and strict alignment?

Relaxed (the default) accepts the checked domain and the sender domain sharing the same organisational domain, so subdomains are allowed. Strict demands an exact match. Strict sounds better but locks out every system that sends from a subdomain, and those are often more than expected.

Where should the reports go?

To a mailbox that can take the volume and is read regularly or evaluated automatically. Aggregate reports arrive daily from every larger receiver and are XML inside ZIP archives, so they are poorly suited to reading by hand. If the address is in another domain, that domain needs an additional entry permitting it; the generator names it.

What is the percentage for?

It applies the policy to a share of the messages only and is meant as a transition: quarantine at 25 percent shows you the effect without affecting all traffic at once. With p=none the percentage does nothing, because there is nothing to apply. The goal is 100 percent.

Does the generator change anything in my DNS?

No. It only produces text that you copy and enter at your DNS provider yourself. It also queries nothing in DNS, it computes purely from what you enter.

DMARC Generator

Put a DMARC record together, with plain words on what the level actually does.

Domain

What should happen to forged mail?

Address for the reports

Subdomains

SPF alignment

DKIM alignment

How many messages does the policy apply to?

A DMARC record tells receiving servers what to do with messages that claim to come from your domain but fail the checks by SPF and DKIM. It is a single TXT entry, and it is the one part of the three mechanisms where you make a decision: monitor, move to spam, or refuse outright. This generator assembles the entry from guided input and tells you what the level you picked actually does.

What the generator does

You choose the policy, enter an address for the reports and, if you want, decide about subdomains and alignment. The generator sets everything else: it puts v=DMARC1 first, places p right behind it, adds the missing mailto: to the report address and leaves out anything that matches the default anyway. A short record in which every entry means something is easier to read than one full of statements of the obvious.

What matters most is the name of the entry. A DMARC record does not sit on the domain itself but on _dmarc. in front of it. A correct record under the wrong name is the single most common setup mistake, and it does not stand out: no report ever arrives. The generator therefore shows the full name right next to the value.

Reading the result

The notes below the record judge the entry, not you. p=none enforces nothing and is explicitly the monitoring stage, p=quarantine is the step in between, and p=reject is the highest level. If a report address is missing, the generator says so plainly, because an entry with p=none and no rua does literally nothing: it enforces nothing and yields no insight either.

Another note appears when the report address sits in a different domain from the one the record is for. That domain then has to permit the reports explicitly, otherwise no serious report generator will send them. The generator names the required entry in full.

Background: what the RFC requires

RFC 7489 is authoritative. It requires the record to start with v=DMARC1 and p to follow immediately; tags are separated by semicolons. The version tag is written exactly like that, in capitals: a v=dmarc1 is ignored completely by real checkers, and the record has the same effect as no record at all.

DMARC only passes when SPF or DKIM passes and the domain checked there matches the visible sender address. That alignment can be required loosely or strictly; relaxed is the default and allows subdomains, strict demands an exact match. Turning it strict without a reason quickly locks out your own systems that send from a subdomain.

Two things are deliberately not on offer. ruf requests forensic reports that contain parts of other people's messages; hardly any receiver still sends them, and asking for them means collecting third-party personal data. And ri, the reporting interval, is practically always right at its default of 24 hours.

Common failure patterns

The record sits on the domain instead of _dmarc. It is then never found, and simply nothing happens.
p=none forever. The monitoring stage is meant as a start, not as a state. Without the step to quarantine and reject, DMARC does not protect the domain.
Rejecting too early. The opposite mistake: setting p=reject before all your own senders pass SPF or DKIM cleanly loses legitimate mail, often invoices and system notifications of all things.
Report address in a foreign domain without its consent. Looks right, never delivers a report.
Several DMARC records. As with SPF, neither of them then applies.

Once the entry is in DNS, check it with the DMARC Analyzer: it reads the published record, rates the policy and names every syntax error.

Common questions

Where do I start, none or reject?: With p=none and a report address. That level changes nothing about delivery but makes sure you receive aggregate reports and see which systems send in your name. There are almost always services among them that nobody remembered. Only once they all pass SPF or DKIM cleanly do you move to quarantine and then to reject. That path takes weeks, not minutes.
Where exactly do I enter the record?: As a TXT entry on _dmarc.your-domain.com. At most providers you only type _dmarc as the name because the domain is appended automatically; the generator shows the full name to be safe. On the domain itself the record is in the wrong place and is never found.
Do I need SPF and DKIM for DMARC to be useful?: Yes. DMARC checks nothing of its own. It evaluates the results of SPF and DKIM and additionally requires the domain checked there to match the visible sender address. Without at least one of the two, no message passes, and an enforced policy would hit your own mail.
What is the difference between relaxed and strict alignment?: Relaxed (the default) accepts the checked domain and the sender domain sharing the same organisational domain, so subdomains are allowed. Strict demands an exact match. Strict sounds better but locks out every system that sends from a subdomain, and those are often more than expected.
Where should the reports go?: To a mailbox that can take the volume and is read regularly or evaluated automatically. Aggregate reports arrive daily from every larger receiver and are XML inside ZIP archives, so they are poorly suited to reading by hand. If the address is in another domain, that domain needs an additional entry permitting it; the generator names it.
What is the percentage for?: It applies the policy to a share of the messages only and is meant as a transition: quarantine at 25 percent shows you the effect without affecting all traffic at once. With p=none the percentage does nothing, because there is nothing to apply. The goal is 100 percent.
Does the generator change anything in my DNS?: No. It only produces text that you copy and enter at your DNS provider yourself. It also queries nothing in DNS, it computes purely from what you enter.