Create a draft policy with explicit reporting addresses and alignment settings.
Your entries stay in this tab. Not sent to or saved by Sky. Export or print before closing or reloading, or your entries will be lost. Do not include passwords, API keys, recipient lists or private logs.
This browser-local generator drafts a DMARC TXT record from your domain, policy, report address and alignment choice. It does not check DNS or prove legitimate mail will pass.
The result title is DMARC record draft. Its summary names _dmarc.your-domain and says nothing was queried or published. p=none gives an info result; quarantine or reject gives a warning. Neither says mail reaches inboxes.
Review Domain, DNS name and Requested policy. Policy specification identifies RFC 9989 and no historic pct tag. DKIM alignment (adkim) and SPF alignment (aspf) show the selected mode. Aggregate-report destinations lists your addresses or Not configured. Both mechanisms use the same mode.
Draft only means you must publish the TXT value through your DNS operator. Monitoring policy selected says p=none requests no quarantine or rejection for failures; it does not prove senders align. Enforcement can affect legitimate mail warns that receivers may handle failing mail under their policies. Report receipt and authorization are unverified: the tool tests neither mailbox, delivery nor external DNS authorization.
An error is titled Input needs correction and repeats the reason, such as an invalid domain or policy, or malformed report addresses. Duplicate destinations are rejected. The percentage-sampling error says pct is unsupported and advises monitoring and reviewed policy changes.
Usual cause: The policy requests receiver handling for messages that fail DMARC. A legitimate source may fail because SPF or DKIM is not aligned with the visible From domain.
Fix: List authorized services, including internal systems and vendors. Check SPF and DKIM alignment, then review aggregate reports before changing policy.
Usual cause: No rua address was entered, so the generated record has no aggregate-report destination.
Fix: Enter an accessible mailbox and confirm it can receive reports. The generator does not create or enroll one.
Usual cause: The RFC requires external report destinations to authorize receipt, preventing unwanted reports from being directed to unrelated domains. This tool does not verify authorization.
Fix: Ask the destination operator to publish DMARC reporting authorization in DNS. Check that separately; the generator only formats rua.
Usual cause: Strict mode requires the From and authenticated SPF or DKIM domains to match exactly. A subdomain relationship accepted in relaxed mode will not match.
Fix: Use relaxed alignment for matching organizational domains, or configure the sender for the exact From domain. Either aligned SPF or DKIM pass can satisfy DMARC.
Usual cause: Common causes: a URL or email instead of a domain, an unsupported policy, display-name mailbox syntax, or a duplicate address.
Fix: Enter a bare domain, select none, quarantine or reject, and list unique plain email addresses separated by commas. Percentage sampling is unsupported.
For example.com, the generator could create v=DMARC1; p=none; rua=mailto:reports@example.net; adkim=r; aspf=r.This requests aggregate reports at reports@example.net and uses relaxed SPF and DKIM alignment. Since the report domain differs, it must authorize external reporting. The generator does not publish or validate this sample.
Many begin with p=none while identifying legitimate senders and correcting authentication. Yahoo's minimum for bulk senders is p=none and it recommends a working rua destination. Monitoring does not repair authentication or stop spoofing by itself.
Move after reports and message checks show authorized sources authenticate and align, and needed exceptions are fixed. Quarantine asks receivers to treat failures as suspicious; reject asks them to refuse them, subject to receiver policy. The guidance gives no universal timetable, and this tool has no percentage rollout.
Yes, if the destination authorizes receipt in DNS under the RFC's reporting verification process. Adding rua does not create authorization; this tool cannot verify it or report delivery.
Relaxed alignment allows the authenticated domain and From domain to share an organizational domain; strict requires an exact match. The generator applies your choice to both adkim and aspf.