Vector · DMARC and SPF generator

Your domain

The domain your mail comes from. Use the root domain, not a subdomain.

What should receivers do with mail that fails?

This is the whole point of DMARC. Everything else is detail.

Monitor only p=none Nothing changes for recipients. You just start receiving reports about who is sending as you. Always start here — you need a few weeks of data before tightening anything. Send to spam p=quarantine Failing mail lands in the junk folder. Move here once your reports show every legitimate sender passing — newsletters, invoicing, CRM, the lot. Refuse outright p=reject Failing mail is bounced at the door and never reaches the recipient. This is the goal, and it's also the setting that breaks real mail if anything is still misconfigured.

Where should reports go?

Without a reporting address DMARC tells you nothing, and you're publishing a policy blind.

rua=mailto:

Failure reports

Per-message reports that can contain subject lines, headers and recipient addresses. Most receivers ignore these, and they carry real privacy weight. Leave off unless you have a specific reason.

Fine tuning

The defaults here are the right answer for almost everyone.

Non-existent subdomains

Mail claiming to come from subdomains you never created, like billing.yourdomain.com. Nothing legitimate sends from these, so reject is safe even while you're still monitoring everything else.

Existing subdomains

Mail from subdomains that do exist. Leave inherited unless they need a different policy. Ignored if you publish this record on a subdomain rather than your root domain.

Testing mode

Asks receivers to apply one level below your stated policy, so you can publish a policy and watch the reports without it biting yet.

DKIM alignment

Relaxed lets a subdomain signature count for the parent domain. Strict demands an exact match.

SPF alignment

Same idea for SPF. Strict breaks a lot of legitimate third-party senders, so relaxed is the sane default.

Show advanced tags

Public suffix declaration and failure reporting options. You almost certainly don't need these.

Your record

Add this as a TXT record in your DNS.

Host: _dmarc
Type: TXT
TTL: 3600 (or your provider's default)

Getting to reject without breaking anything

DMARC goes wrong when people jump straight to the end. Each stage wants a few weeks of reports behind it.

Stop people sending mail as you.

Your domain

What should receivers do with mail that fails?

Where should reports go?

Fine tuning

Who sends mail for this domain?

Anything else

Your record

Getting to reject without breaking anything