DMARC record builder

Which policy should you start with?

Start with none. It changes nothing about delivery, and the reports from receivers that send them show which servers send mail in your name, including ones you forgot about.

Once the reports show only your own services passing, move to quarantine, which sends failing mail to spam. When that has run cleanly for a few weeks, move to reject.

What do the other options do?

Each one has a safe default, so change it only for the reason given here.

Policy for subdomains

By default subdomains follow the main policy. Set it apart only when a subdomain's mail needs different treatment.

Share of failing mail

Applies the policy to only part of the failing mail while you test. Leave it at 100 once the reports are clean.

Address for the daily reports

Where the daily reports go. A report service or a shared mailbox is easier to read than a personal inbox.

Alignment

Relaxed lets mail sent from a subdomain count for the main domain. Strict needs an exact match, which can break mail from services that use their own subdomain.

Where does the record go?

Add it as a TXT record named _dmarc on your domain. In most DNS panels you type _dmarc as the host and paste the record as the value. Keep only one DMARC record.

After publishing, run the email health check to confirm it reads the way you intended.

Is anything typed here sent to you?

No. The builder writes the record in your browser and asks nothing of the internet. It stores nothing and sends nothing to us. The page shows no ads. Nothing reaches us unless you write to us through the contact form.