[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"tools-page-dmarc-record-generator":3},{"page":4,"related":249,"variants":261},{"path":5,"name":6,"title":7,"description":8,"checkedAt":9,"sources":10,"faq":50,"related":69,"nuxter":72,"body":75,"tool":247,"preset":248},"\u002Ftools\u002Fdmarc-record-generator","DMARC record generator","DMARC Record Generator with a Staged Rollout","A DMARC record generator built on RFC 9989. Roll out with t=y instead of pct, set np and report addresses, compare with your live record and build SPF too.","2026-10-06",[11,14,17,20,23,26,29,32,35,38,41,44,47],{"label":12,"url":13},"RFC 9989, section 4.7, DMARC Policy Record Format","https:\u002F\u002Fwww.rfc-editor.org\u002Frfc\u002Frfc9989#section-4.7",{"label":15,"url":16},"RFC 9989, section 7.4, Interoperability Considerations","https:\u002F\u002Fwww.rfc-editor.org\u002Frfc\u002Frfc9989#section-7.4",{"label":18,"url":19},"RFC 9989, appendix A.6, Removal of the \"pct\" Tag","https:\u002F\u002Fwww.rfc-editor.org\u002Frfc\u002Frfc9989#appendix-A.6",{"label":21,"url":22},"RFC 9989, appendix C.5, Tags","https:\u002F\u002Fwww.rfc-editor.org\u002Frfc\u002Frfc9989#appendix-C.5",{"label":24,"url":25},"RFC 9990, section 4, Verifying External Destinations","https:\u002F\u002Fwww.rfc-editor.org\u002Frfc\u002Frfc9990#section-4",{"label":27,"url":28},"RFC 7208, section 4.6.4, DNS Lookup Limits","https:\u002F\u002Fwww.rfc-editor.org\u002Frfc\u002Frfc7208#section-4.6.4",{"label":30,"url":31},"Cloudflare docs, Manage DNS records","https:\u002F\u002Fdevelopers.cloudflare.com\u002Fdns\u002Fmanage-dns-records\u002Fhow-to\u002Fcreate-dns-records\u002F",{"label":33,"url":34},"Cloudflare docs, DMARC Management","https:\u002F\u002Fdevelopers.cloudflare.com\u002Fdmarc-management\u002F",{"label":36,"url":37},"Cloudflare Email Service docs, Domain configuration","https:\u002F\u002Fdevelopers.cloudflare.com\u002Femail-service\u002Fconfiguration\u002Fdomains\u002F",{"label":39,"url":40},"Resend docs, Implementing DMARC","https:\u002F\u002Fresend.com\u002Fdocs\u002Fdashboard\u002Fdomains\u002Fdmarc",{"label":42,"url":43},"Google Workspace Admin Help, Set up SPF","https:\u002F\u002Fknowledge.workspace.google.com\u002Fadmin\u002Fsecurity\u002Fset-up-spf",{"label":45,"url":46},"Microsoft Learn, Set up SPF for your Microsoft 365 domain","https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fdefender-office-365\u002Femail-authentication-spf-configure",{"label":48,"url":49},"Amazon SES docs, Using a custom MAIL FROM domain","https:\u002F\u002Fdocs.aws.amazon.com\u002Fses\u002Flatest\u002Fdg\u002Fmail-from.html",[51,54,57,60,63,66],{"question":52,"answer":53},"What should my first DMARC record be?","Publish p=none with a rua address you can read, such as v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com. It changes nothing about delivery and starts the reports that show who sends as your domain. Tighten it only once those reports show your own mail passing.",{"question":55,"answer":56},"What replaced pct in DMARC?","The t tag. RFC 9989 removed pct because receivers applied values between 0 and 100 inconsistently. t=y keeps the useful part of pct=0, asking receivers to apply the policy one level down while some intermediaries rewrite the From header.",{"question":58,"answer":59},"What does np mean in a DMARC record?","np is the policy for subdomains that don't exist. Without it, they follow sp, or p when there is no sp. Setting np=reject stops mail from made-up subdomains without changing how the subdomains you use are treated.",{"question":61,"answer":62},"Do I need a rua address?","Not for the policy to work, but without one receivers send you no aggregate reports, and you can't tell when tightening the policy would block your own mail. Use an address on your domain, a report service, or Cloudflare DMARC Management if your DNS is on Cloudflare.",{"question":64,"answer":65},"How do I send DMARC reports to another domain?","List the address in rua as usual, then have the receiving domain publish a TXT record at yourdomain._report._dmarc.theirdomain with the value v=DMARC1;. Receivers check for it before they send reports outside your domain. The generator writes that record for each outside address.",{"question":67,"answer":68},"Should I use p=reject?","For a domain that only sends transactional mail from systems you control, reject is the goal once reports are clean. RFC 9989 advises domains whose people post to mailing lists not to publish it, and a domain with p=reject must sign its mail with DKIM rather than rely on SPF alone.",[70,71],"spf-dkim-dmarc-checker","html-email-preview",{"body":73,"to":74},"Nuxter's mail goes out through its Cloudflare Email Service or Resend adapter. Publish this record beside the SPF and DKIM records they ask for, and move it a stage at a time.","\u002Ffeatures",{"type":76,"value":77,"toc":238},"minimark",[78,83,134,149,153,163,178,182,193,201,205,214,225,229],[79,80,82],"h2",{"id":81},"the-tags-after-rfc-9989","The tags after RFC 9989",[84,85,86,87,91,92,95,96,99,100,102,103,106,107,110,111,114,115,118,119,114,122,125,126,129,130,133],"p",{},"A DMARC record is a TXT record at ",[88,89,90],"code",{},"_dmarc.\u003Cdomain>"," made of ",[88,93,94],{},"tag=value"," pairs separated by semicolons, and ",[88,97,98],{},"v=DMARC1"," must come first. ",[88,101,84],{}," is the policy for the domain, ",[88,104,105],{},"sp"," for its existing subdomains and ",[88,108,109],{},"np"," for subdomains that don't exist. ",[88,112,113],{},"adkim"," and ",[88,116,117],{},"aspf"," choose relaxed or strict alignment, ",[88,120,121],{},"rua",[88,123,124],{},"ruf"," say where reports go, and ",[88,127,128],{},"fo"," says when a failure report is wanted. ",[88,131,132],{},"t=y"," marks the policy as a test.",[84,135,136,137,140,141,144,145,148],{},"The generator leaves out every tag set to its default and never writes ",[88,138,139],{},"pct",", ",[88,142,143],{},"rf"," or ",[88,146,147],{},"ri",", which RFC 9989 removed.",[79,150,152],{"id":151},"rolling-out-with-ty","Rolling out with t=y",[84,154,155,156,159,160,162],{},"Start at ",[88,157,158],{},"p=none"," with a report address, and read the reports until every server that sends as you passes. Then take each stricter policy in two steps: first with ",[88,161,132],{},", which asks receivers to apply it one level down, then without. That makes four steps after monitoring: test quarantine, quarantine, test reject and reject.",[84,164,165,166,169,170,173,174,177],{},"For a domain whose people post to mailing lists, RFC 9989 suggests at least a month at ",[88,167,168],{},"none"," and as long again at ",[88,171,172],{},"quarantine"," before ",[88,175,176],{},"reject",". A domain that only sends transactional mail has few senders to account for, so it can usually move faster.",[79,179,181],{"id":180},"subdomains-and-np","Subdomains and np",[84,183,184,185,188,189,192],{},"A spoofer who can't send as your domain may try a name like ",[88,186,187],{},"billing.\u003Cdomain>"," that doesn't exist. ",[88,190,191],{},"np=reject"," asks receivers to refuse that mail without changing how the subdomains you use are treated.",[84,194,195,196,144,198,200],{},"A record published on a subdomain applies to that subdomain. Receivers fall back to the parent's record, read through ",[88,197,105],{},[88,199,109],{},", only when the subdomain has none of its own.",[79,202,204],{"id":203},"reports-and-authorizing-another-domain","Reports, and authorizing another domain",[84,206,207,208,210,211,213],{},"Aggregate reports are XML files that list, for each sending IP address, how many messages passed or failed SPF, DKIM and DMARC. They go to the ",[88,209,121],{}," addresses, and they are hard to read by hand, so most people point ",[88,212,121],{}," at a report service.",[84,215,216,217,220,221,224],{},"When an address is on another domain, that domain must publish a TXT record at ",[88,218,219],{},"\u003Cyour domain>._report._dmarc.\u003Cits domain>"," containing ",[88,222,223],{},"v=DMARC1;",", or receivers won't send to it. A report service can publish one wildcard record that accepts reports for every domain.",[79,226,228],{"id":227},"check-what-you-published","Check what you published",[84,230,231,232,237],{},"Once the record is live, run the ",[233,234,236],"a",{"href":235},"\u002Ftools\u002Fspf-dkim-dmarc-checker","SPF, DKIM and DMARC checker"," with your provider's preset. It finds the policy the way receivers do, follows your SPF includes and checks that every outside report address has authorized your domain.",{"title":239,"searchDepth":240,"depth":240,"links":241},"",2,[242,243,244,245,246],{"id":81,"depth":240,"text":82},{"id":151,"depth":240,"text":152},{"id":180,"depth":240,"text":181},{"id":203,"depth":240,"text":204},{"id":227,"depth":240,"text":228},"dmarc-record-generator",null,[250,254],{"path":235,"tool":70,"name":236,"title":251,"description":252,"summary":253,"checkedAt":9},"SPF DKIM DMARC Checker for Resend and Cloudflare","A free SPF DKIM DMARC checker with presets for Resend, Cloudflare Email, Google and Microsoft 365. Reads the right hosts, counts SPF lookups, explains fixes.","Look up and grade a domain's SPF, DKIM and DMARC, with presets that read the hosts Resend, Cloudflare and others use.",{"path":255,"tool":71,"name":256,"title":257,"description":258,"summary":259,"checkedAt":260},"\u002Ftools\u002Fhtml-email-preview","HTML email preview","HTML Email Preview: Desktop, Mobile and Dark Mode","A free HTML email preview: see your email at desktop and mobile widths in light, dark and forced dark, with checks for Gmail clipping, alt text and links.","See a transactional email at desktop and mobile widths, in light and dark, with checks for clipping, alt text and links.","2026-10-07",[]]