DMARC Record Generator with a Staged Rollout

The tags after RFC 9989

A DMARC record is a TXT record at _dmarc.<domain> made of tag=value pairs separated by semicolons, and v=DMARC1 must come first. p is the policy for the domain, sp for its existing subdomains and np for subdomains that don't exist. adkim and aspf choose relaxed or strict alignment, rua and ruf say where reports go, and fo says when a failure report is wanted. t=y marks the policy as a test.

The generator leaves out every tag set to its default and never writes pct, rf or ri, which RFC 9989 removed.

Rolling out with t=y

Start at p=none with a report address, and read the reports until every server that sends as you passes. Then take each stricter policy in two steps: first with t=y, which asks receivers to apply it one level down, then without. That makes four steps after monitoring: test quarantine, quarantine, test reject and reject.

For a domain whose people post to mailing lists, RFC 9989 suggests at least a month at none and as long again at quarantine before reject. A domain that only sends transactional mail has few senders to account for, so it can usually move faster.

Subdomains and np

A spoofer who can't send as your domain may try a name like billing.<domain> that doesn't exist. np=reject asks receivers to refuse that mail without changing how the subdomains you use are treated.

A record published on a subdomain applies to that subdomain. Receivers fall back to the parent's record, read through sp or np, only when the subdomain has none of its own.

Reports, and authorizing another domain

Aggregate reports are XML files that list, for each sending IP address, how many messages passed or failed SPF, DKIM and DMARC. They go to the rua addresses, and they are hard to read by hand, so most people point rua at a report service.

When an address is on another domain, that domain must publish a TXT record at <your domain>._report._dmarc.<its domain> containing v=DMARC1;, or receivers won't send to it. A report service can publish one wildcard record that accepts reports for every domain.

Check what you published

Once the record is live, run the SPF, DKIM and DMARC checker with your provider's preset. It finds the policy the way receivers do, follows your SPF includes and checks that every outside report address has authorized your domain.