DMARC generator

What this does

Builds a DMARC TXT record and tells you where it goes: on _dmarc. in front of your domain, never on the domain itself.

Start with none

p=none only asks for reports — it does not protect anything. Read the reports that come to your rua address for a while, fix what is failing, then move to quarantine and finally reject. Jumping straight to reject can block your own legitimate mail.

rua and alignment

Without an rua address you get no reports and cannot see what is failing. Strict alignment (adkim=s, aspf=s) requires the signing or sending domain to match exactly, not just share a parent domain — tighter, but more likely to break mail sent through a third party.