Pick your mail provider and the policy you want, and get the three DNS records to publish, a plain-English reading of what they do, and a staged path from monitoring to enforcement that doesn’t bounce your own mail on the way.
This is a learning tool. It runs entirely in your browser — nothing you type
is submitted, stored or logged, and it never touches your DNS. It builds the records so you can
understand them and publish them yourself. Always check them against your provider’s own
guidance (Microsoft 365, Google Workspace) and a live DNS lookup before publishing, and watch
the DMARC reports at each step — email-auth guidance shifts as standards like DMARCbis land.
DKIM values come from your provider’s admin portal, so this tool emits
<PLACEHOLDER> tokens for them.
Aligned with DMARCbis (RFC 9989/9990/9991, May 2026): the deprecated pct,
rf and ri tags are not emitted; staged rollout uses t=y
testing mode, and np (non-existent-subdomain policy) is included.
SPF is a published list of who is allowed to send for your domain. A receiver checks the sending server’s IP against it.
DKIM puts a cryptographic signature on each message. The receiver fetches your public key from DNS and verifies the mail wasn’t forged or altered in transit.
DMARC ties both back to the domain a human sees in the From: field (“alignment”), tells receivers what to do when neither check passes in alignment, and — the part people underuse — asks them to send you daily reports on who is sending as you.
A message passes DMARC if SPF or DKIM passes and that passing check is aligned with the From domain. One aligned pass is enough.
The failure mode of DMARC is blocking your own legitimate mail — a forgotten newsletter platform, an app server nobody documented. So you move in steps, and you only take the next one when the aggregate reports show every real sender passing, in alignment, for a week or two.
p=none — nothing is enforced; you are only collecting reports. Stay here until you recognise every source.p=quarantine; t=y — you’ve declared quarantine, but t=y tells receivers to still act as none. A dress rehearsal.p=quarantine — drop t=y. Failing mail now goes to spam. Watch for a week.p=reject; t=y — declared reject, receivers act as quarantine. Last checkpoint.p=reject — failing mail is refused outright. The destination.include, a, mx, ptr, exists and redirect costs a DNS lookup, and their includes count too. Over ten and SPF returns permerror — treated as a fail. Consolidate or use a provider that flattens.p=reject. Every skipped step is mail you might be silently dropping. The reports are the whole point — read them.bounces.theirdomain.com passes SPF for their domain, which doesn’t align with yours. Either have them DKIM-sign as your domain, or set a custom return-path so SPF aligns.pct, rf and ri — DMARCbis removed them. pct in particular no longer does what you think; use t=y for a staged step.