DE EN IT

~/tools / dmarc-record-generator

DMARC record generator

Pick a policy, add a report address — and you have the TXT record for _dmarc.

daniele@mikweb: ~/tools — less dmarc-record-generator.md

The safe way to p=reject

  1. Start with p=none and a report address (rua).
  2. Read the reports for two to four weeks: which services send in your name, and do they pass SPF or DKIM?
  3. Add the missing services to SPF and DKIM.
  4. Move to quarantine, later to reject.

Common mistakes

  • Two DMARC records at _dmarc: then none applies.
  • A report address on another domain without the authorisation record (_report._dmarc) at the receiver.
  • reject too early: newsletter and ticket systems break.

How well do big domains protect their mail?

The e-mail ranking shows SPF, DMARC and MTA-STS of about 100 well-known domains, with a live check on every row.

Privacy

Runs entirely in your browser; nothing is sent or stored.

daniele@mikweb: ~/blog — ls

Related articles

Mail landing in spam: SPF, DKIM and DMARC alignment explainedSPF, DKIM and DMARC explained simply: what each checks, why mail lands in spam although SPF passes, how to read headers — with a table and checklist.
daniele@mikweb: ~/errors — grep

Matching error pages

not accepted due to domain's DMARC policy550 5.7.1 Unauthenticated email is not accepted due to domain's DMARC policydkim=fail body hash did not verifyDKIM: dkim=fail (body hash did not verify)550 5.1.1SMTP 550 5.1.1: user unknown / recipient address rejectedMatching error pages →
daniele@mikweb: ~/tools — ls

Tools

SPF checkerCounts the DNS lookups of your SPF record (limit: 10).DNS TTL plannerPlans the TTL reduction and the move time.Cron explainerExplains cron expressions and shows the next runs.Mail DNS checkChecks MX, reverse DNS, SPF, DMARC and MTA-STS of a domain.Certificate checkExpiry, chain and names of a TLS certificate.Security headersGrades HSTS, CSP and other security headers.JWT decoderShows header, claims and expiry of a JWT — in your browser only.SAML decoderDecodes SAML responses and spots typical errors.nginx for NextcloudGenerates an nginx config for Nextcloud with PHP-FPM.Explain an errorPaste an error — meaning, causes and checks (AI).Base64 encode/decodeEncode and decode Base64, files and Basic-auth headers included — in your browser only.chmod calculatorFile permissions octal ↔ symbolic, ready chmod commands and umask — in your browser only.Subnet calculatorWorks out CIDR, netmask, wildcard and hosts for IPv4 and IPv6 and splits networks into subnets.Epoch converterConvert Unix timestamps to dates and back, with time zones and a year-2038 check — in your browser only.Hash generatorSHA-256, SHA-512, SHA-1 and MD5 for text and files, with HMAC and a compare field — in your browser only.JSON formatterFormat, minify, sort and validate JSON, with errors shown by line and column — in your browser only.Nextcloud checkVersion, patch level, end of life and exposed paths of a Nextcloud.Password generatorRandom passwords and passphrases with an entropy readout — generated in your browser only.Redirect generatorGenerates redirects for nginx and Apache (.htaccess) with a curl test.

← Tools