DMARC record generator

Builds a DMARC record on the current specification — RFC 9989, which removed pct, rf and ri. If you paste a domain, the existing record is read first, and any report address on another domain is checked live for the authorisation it needs.

DomainPolicy (p)Start at none, read the reports, then move up. Publishing reject before the reports are clean stops your own mail.Aggregate report address (rua)Where the daily reports go. Without it, none has nothing to show you.

Existing subdomains (sp)Leave inherited unless subdomains need a different policy.Non-existent subdomains (np)Added by DMARCbis. A great deal of spoofing is aimed at subdomains that never existed.DKIM alignment (adkim)Relaxed accepts a subdomain; strict demands an exact match.SPF alignment (aspf)Relaxed accepts a subdomain; strict demands an exact match.

Failure report address (ruf) — optionalPer-message failure reports. Few receivers send these, and they can carry recipient addresses.Test mode (t=y)Asks receivers to report without applying the policy in full. Remember to remove it — a record left in test mode enforces nothing.

The record is built in your browser. Domain lookups go to Cloudflare’s DNS resolver and nowhere else — nothing you type is sent to a server of ours.