Build DMARC DNS records with policy configuration, reporting settings, and alignment mode selection.
A DMARC record expresses a domain's email authentication policy as a series of tagged values. This generator combines the selected none, quarantine, or reject policy with reporting destinations and relaxed or strict DKIM and SPF alignment modes, producing text suitable for a DNS TXT record. It also supplies DMARC's required version declaration. The generated text does not activate DMARC by itself. You must publish it under the _dmarc hostname for the policy domain, and receiving mail systems ultimately decide how to handle failing messages.
A concrete input and expected output from the current implementation.
Input
Policy: reject Aggregate reports: mailto:[email protected] DKIM alignment: strict SPF alignment: relaxed
Expected output
v=DMARC1; p=reject; rua=mailto:[email protected]; adkim=s; aspf=r
The record declares DMARC version 1 and requests rejection for failing messages. The rua tag names the aggregate-report destination, while s and r encode strict DKIM alignment and relaxed SPF alignment.
The generator converts the selected policy into the required v and p tags, then appends chosen reporting and alignment tags. Report destinations are expressed as URIs such as mailto:[email protected]. DKIM alignment is written as adkim=r or adkim=s, while SPF alignment is written as aspf=r or aspf=s. The result is one semicolon-separated DMARC record value.
Publish the returned value as a TXT record at _dmarc followed by the policy domain. During evaluation, a message passes DMARC when at least one passing authentication result from DKIM or SPF aligns with the domain in the visible From field. The p tag states the requested handling for messages that fail; receiving systems retain control over the actual disposition.
No. The record tells receivers how to evaluate and report mail for the domain. DMARC passes only when a passing DKIM signature or SPF result aligns with the visible From domain. If neither path is configured and aligned, changing p to quarantine or reject can cause legitimate messages to be treated as failing.
Relaxed alignment permits authenticated subdomains that share an organizational domain with the visible From domain; strict alignment requires an exact domain match. Relaxed often accommodates more sending arrangements. The generator cannot infer the right choice from a domain name alone, so base it on the DKIM signing domains and SPF-authenticated domains used by actual mail streams.
The example and behavioral notes were checked against the browser implementation. Standards and primary references below define the relevant format, formula, or platform behavior.
Generate strong, random passwords with customizable length, character sets, and complexity requirements.
Analyze password strength with entropy scoring, crack-time estimates, and improvement suggestions.
Create cryptographically random strings for API keys, tokens, salts, and unique identifiers.
Create QR codes for URLs, text, Wi-Fi credentials, vCards, and more with customizable size and colors.
Scan and decode QR codes from uploaded images or your device camera to extract embedded data.
Compute MD5, SHA-1, SHA-256, and SHA-512 checksums to verify file integrity and detect tampering.