Greater Montréal: we come to you, free of charge, to talk it through.
Skip to content

DMARC record generator

Create your DMARC record in one minute: policy, reports, subdomains, alignment. The result is ready to paste into your DNS.

TypeTXTHost_dmarc.your-domain.ca
Record value
v=DMARC1; p=none

p=none blocks nothing: it is the observation stage. Read the reports for a few weeks, then move to quarantine and reject.

Without an rua address you get no reports, so you won’t know who sends as you.

The tags, explained

  • p: what recipients do with a failing message (none = nothing, quarantine = spam, reject = refused).
  • sp: the same rule for your subdomains.
  • rua: where to receive daily reports. Use a dedicated mailbox or an analysis service: reports are XML files.
  • pct: the share of messages the policy applies to, useful for a gradual rollout.
  • adkim / aspf: relaxed (r, subdomains accepted) or strict (s) alignment.

Rollout in three steps

  1. Publish p=none with an rua address.
  2. Over a few weeks, authenticate every legitimate service (SPF and DKIM).
  3. Move to quarantine, then reject.

Frequently asked questions

Where do I publish the DMARC record?+

In your domain’s DNS zone, at your registrar or DNS host: a TXT record whose host is _dmarc (i.e. _dmarc.your-domain.ca).

Do I need SPF and DKIM before DMARC?+

Yes. DMARC checks that SPF or DKIM passes with a domain aligned with the visible address. Without them, moving to quarantine or reject would block your own email.

How long should I stay at p=none?+

Long enough to identify all your legitimate senders in the reports: often a few weeks. Then move to quarantine, then reject.