Current RFC 9989 · no signup

Build a DMARC record you can safely roll out.

Generate the exact DNS value, understand when to use it, and catch external-reporting requirements before publishing. Everything stays in this browser tab.

No removed pct tagSafe monitoring defaultDNS-ready output

Policy builder

Your DMARC record

How is this domain used?Sends emailStart with reportingParked / never sendsReject all spoofed use

DomainAggregate report address (rua)Use a dedicated mailbox or a reporting provider—not a personal inbox.

Rollout stagep=noneMonitor firstp=quarantineAfter clean reportsp=rejectFinal enforcement

Advanced settings

Subdomain policyDKIM alignmentSPF alignment

TXT · _dmarc.example.comv=DMARC1; p=none; rua=mailto:dmarc@example.com

RFC 9989 · May 2026

Current syntax, without obsolete rollout controls.

The current DMARC standard removed pct because receivers applied percentages inconsistently. MX Audit therefore does not generate pct. Start at p=none, inspect real aggregate reports, then move the complete policy to quarantine and reject.

Why pct was removed ↗

Before and after publishing

Check the live record

Run the domain scanner before and after the DNS change. It detects multiple records, missing reporting, and weak enforcement.

Check domain →02

Read the evidence

Analyze XML, ZIP, or GZIP reports locally and see which legitimate sources would fail before choosing reject.

Analyze reports →

Need a managed reporting address?

Turn XML reports into a sender inventory.

DMARCTrust provides a reporting address, readable dashboards, and alerts. Its evaluation tier is limited to one domain; paid business plans start at $19/month for two domains.

Test monitoring free ↗Not a partner link yet: MX Audit currently receives no compensation.

Primary sources