DE EN IT

~/tools / dmarc-record-generator

DMARC record generator

Pick a policy, add a report address — and you have the TXT record for _dmarc.

daniele@mikweb: ~/tools — less dmarc-record-generator.md

The safe way to p=reject

  1. Start with p=none and a report address (rua).
  2. Read the reports for two to four weeks: which services send in your name, and do they pass SPF or DKIM?
  3. Add the missing services to SPF and DKIM.
  4. Move to quarantine, later to reject.

Common mistakes

  • Two DMARC records at _dmarc: then none applies.
  • A report address on another domain without the authorisation record (_report._dmarc) at the receiver.
  • reject too early: newsletter and ticket systems break.

Privacy

Runs entirely in your browser; nothing is sent or stored.

daniele@mikweb: ~/blog — ls

Related articles

Mail landing in spam: SPF, DKIM and DMARC alignment explainedSPF passes but mail still lands in spam? Why DMARC needs alignment, how to read mail headers and how to roll out SPF, DKIM and DMARC in order.
daniele@mikweb: ~/tools — ls

Tools

SPF checkerCounts the DNS lookups of your SPF record (limit: 10).DNS TTL plannerPlans the TTL reduction and the move time.Cron explainerExplains cron expressions and shows the next runs.Mail DNS checkChecks MX, reverse DNS, SPF, DMARC and MTA-STS of a domain.Certificate checkExpiry, chain and names of a TLS certificate.Security headersGrades HSTS, CSP and other security headers.JWT decoderShows header, claims and expiry of a JWT — in your browser only.SAML decoderDecodes SAML responses and spots typical errors.

← Tools