generate_dmarc
Generate a DMARC TXT record with a safe enforcement policy, aggregate reporting, and rollout controls, including warnings about mistakes that break legitimate mail.
Instructions
Build a DMARC record — the _dmarc TXT record that tells receivers what to do when a message fails SPF and DKIM alignment, and where to send reports about it. The risk here is not syntax but policy. p=none monitors without affecting delivery and is where every deployment starts; p=quarantine sends failures to spam; p=reject refuses them outright, which silently destroys legitimate mail from any sender that was missed and gives that sender no explanation. Always publish a rua address: without aggregate reports there is no way to see which senders fail before enforcing against them. Use percentage to apply an enforcing policy to only part of the mail while rolling out. Returns the record, the host to publish it on (_dmarc), and warnings covering the mistakes that actually break mail — enforcing without reporting, reject at full coverage, pct at p=none, and strict alignment breaking subdomain senders and ESPs. Nothing is looked up or stored.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| pct | No | Alias for `percentage`, matching the DNS tag name. | |
| rua | No | Aggregate report address(es). mailto: is added automatically. | |
| ruf | No | Forensic report address(es). Contains message content and is honoured by very few receivers. | |
| policy | No | p= — start at 'none' and only enforce once reports show all legitimate senders aligning. Defaults to none. | |
| percentage | No | pct= — share of mail the policy applies to, for a gradual rollout. Has no effect at p=none. Also accepted as `pct`. | |
| spfAlignment | No | aspf= — strict requires an exact domain match and breaks subdomain senders. | |
| dkimAlignment | No | adkim= — strict requires an exact domain match and breaks many ESPs. | |
| reportInterval | No | ri= — seconds between aggregate reports. Defaults to 86400 (daily). | |
| subdomainPolicy | No | sp= — a different policy for subdomains. Omitted when it matches the main policy. |