Tools
DMARC record generator.
Build a valid DMARC record tag by tag, every option explained, then copy it straight into DNS.
Add this as a TXT record at _dmarc.yourdomain.com
Policy
What receivers do with mail that fails, and how much of it.
Only used to show the DNS host name. Never sent anywhere.
Start at none, climb to reject once you trust your reports.
Override the policy for subdomains. Usually leave as is.
Share of mail the policy applies to, for a gradual rollout. Omitted when 100.
Reporting
Where the daily summaries and failure reports are sent.
Daily XML summaries of who sends as you. Comma-separate several. The whole point of DMARC.
Per-message failure samples. Rare, may contain content. Leave blank unless needed.
Only affects forensic (ruf) reports. Unchecked uses the default fo=0 (report only when everything fails).
Seconds between aggregate reports. Most receivers only honour 86400 (a day). Omitted when 86400.
Alignment
How closely the authenticated domain must match your From address.
Relaxed lets mail.you.com align with you.com. Omitted when relaxed.
Same idea as DKIM alignment, for the SPF domain. Omitted when relaxed.
This check is a snapshot. dmarcula watches your domain around the clock, reads the DMARC reports for you, and emails you when something changes. Free, no credit card.