✅ DMARC Record Builder

DMARC (Domain-based Message Authentication, Reporting & Conformance) is a DNS TXT record that tells receiving mail servers what to do when an email fails SPF or DKIM authentication — and reports back to you about those failures. It ties SPF and DKIM together by requiring that the authenticated domain "aligns" with the visible From: address in the email. DMARC is required by Google and Yahoo for bulk senders (those sending 5,000+ emails/day to Gmail or Yahoo), and strongly recommended for all domains to prevent spoofing and phishing.

Always start with p=none (monitor mode). This collects aggregate reports without affecting email delivery. Review the reports for 2–4 weeks to identify all legitimate email sources and confirm SPF and DKIM are passing for each. Once you're confident all legitimate senders are authenticated, move to p=quarantine to send failing emails to spam, then eventually to p=reject to block them entirely. Skipping the monitor phase and going straight to p=reject is risky — you may accidentally block legitimate email.

No — a single DMARC record at _dmarc.yourdomain.com applies to the root domain and all subdomains by default. Subdomains that don't have their own DMARC record inherit the parent policy. You only need a separate DMARC record on a subdomain if you want a different policy for that subdomain. You can use the sp= tag to set a different policy for subdomains without adding separate records — for example, p=reject; sp=none rejects on the root domain but only monitors on subdomains.

Aggregate reports are daily XML files sent by receiving mail servers (like Google, Microsoft, Yahoo) to your specified RUA email address. They list every IP address that sent email claiming to be from your domain, along with SPF and DKIM pass/fail results and the DMARC disposition applied. These reports are essential for: identifying all your legitimate email senders, detecting spoofing attempts, troubleshooting authentication failures, and safely advancing your DMARC policy. You should always set a RUA address — it's free information that is critical for managing your email security posture.

Alignment is the requirement that the domain in the SPF or DKIM result matches the domain in the email's visible From: address. Relaxed alignment (default) allows subdomains — so mail.example.com satisfies DMARC for example.com. Strict alignment requires an exact match. Relaxed alignment is recommended for most deployments as it is more forgiving of common sending configurations. Use strict alignment only if you have a specific security requirement and have verified it won't break legitimate email flows.