Which DMARC policy should I start with?

Start with p=none and a rua= report address. Read the reports for a few weeks, fix SPF or DKIM for every legitimate sender, then move to quarantine and reject.

What is the host name of a DMARC record?

A TXT record at _dmarc under your domain, for example _dmarc.example.com. In most DNS panels you enter _dmarc as the host.

Do DMARC reports contain my emails?

Aggregate (rua) reports do not: they list sending IP addresses, message counts and authentication results. Failure (ruf) reports can include message details, which is why few providers send them.

DMARC record generator

TXT at _dmarc.your domain

v=DMARC1; p=none

p=none: monitoring only.
Receivers send you reports but do nothing with mail that fails, so your domain can still be spoofed. It meets the Gmail and Yahoo minimum for bulk senders, and it is the right first step.
Fix: Read the reports for a few weeks; when your own mail passes, move to p=quarantine, then p=reject.
No rua= address: you get no reports.
Aggregate reports show who sends mail as your domain and whether it passes. Without them you cannot safely move to quarantine or reject.
Fix: Add rua=mailto:dmarc-reports@example.com (any mailbox you read, or a DMARC report service).

Choose a policy, add the addresses that should receive reports and pick the alignment mode. The record updates as you type, with notes on anything that weakens it, following RFC 7489. Everything runs in your browser.

Publish it

In your DNS host, add a TXT record with the host _dmarc (some hosts want the full name, _dmarc.example.com) and the record as its value.
Keep only one DMARC record on that name: with two, receivers apply neither.
Check it with our DMARC checker once the old TTL has passed.

DMARC needs SPF or DKIM to pass on your own domain first; set those up with the SPF generator and your mail provider's DKIM instructions.

Choosing the policy

p=none — receivers only report. Start here: it changes nothing for your mail and shows you every source that sends as your domain. It also meets the Gmail and Yahoo minimum for bulk senders.
p=quarantine — failing mail goes to the spam folder. Move here when the reports show that all your own mail passes.
p=reject — failing mail is refused. The goal: the strongest protection against spoofing, and a requirement (with quarantine) for BIMI logos.

pct= applies the policy to a share of failing mail only, which lets you move from none to quarantine in steps. Remove it (or set 100) when you are done.

Reports

rua= addresses receive aggregate reports: one XML file per receiver per day, listing the sending IPs, message counts and SPF/DKIM results. They contain no message content. Use a mailbox you read, or a DMARC report service that turns the XML into charts. If the address is on another domain, that domain must authorise it with a TXT record at <your domain>._report._dmarc.<their domain> (RFC 7489 §7.1); report services do this for you.

ruf= asks for failure reports about single messages. Few large providers send them, and they can include parts of the message, so leave it out unless you need it.

Alignment

Relaxed alignment (r, the default) accepts a subdomain: mail with From example.com passes on DKIM signed by mail.example.com. Strict alignment (s) needs the exact domain. Keep relaxed unless you have a reason; strict breaks mail from services that sign or bounce on a subdomain of yours.

Checking email addresses rather than domains? Try our free email checker or see pricing for lists and the API.