The tags the generator writes
v=DMARC1 and p are always present, and p takes none, quarantine or reject. sp sets a different policy for subdomains and is omitted when it equals p, since receivers default it that way. pct is a whole number from 0 to 100 and is written only below 100. rua and ruf take one or more mailto: URIs. You can type the addresses separated by spaces, commas or semicolons, with or without the mailto: prefix, and the generator normalizes them.
adkim and aspf control alignment: r (relaxed) accepts any subdomain of the organizational domain, s (strict) requires an exact match. ri is the requested interval between aggregate reports in seconds, written only when you move the selector off 24 hours. fo decides when a forensic report is generated: 0 means both SPF and DKIM failed, 1 means either failed, d a DKIM failure, s an SPF failure.
Picking a policy for each stage
Start at p=none with a rua address. The record delivers everything as before and gets receivers sending you aggregate reports, which is how you learn which hosts send as your domain and whether their SPF and DKIM pass. Read those reports in the DMARC Report Analyzer before changing anything else.
When every legitimate source passes, switch to quarantine. If you are cautious, set pct to 25 or 50 so only part of the failing mail is affected and the remainder gets the weaker policy. Raise pct to 100, then move to reject. The generator shows a pass only for reject at 100, because that is the state in which forged mail is refused rather than filed under spam.
Subdomains, alignment and intervals
sp matters more than it looks. With p=reject and no sp, subdomains inherit reject, which is what you want. Setting sp=none to keep a subdomain working leaves it open to forgery, and the Checks card warns about that combination. The better fix is to give the subdomain a correct SPF and DKIM setup and let it inherit the strict policy.
Strict alignment rarely adds security and often breaks mail from services that sign with a subdomain or use a bounce subdomain for SPF, so Relaxed is the default for a reason. The report interval is a request, not a guarantee. Most receivers send one aggregate report a day whatever ri says, so 24 hours is the honest choice.
Publishing the record
At your DNS host, add a TXT record. The host name is _dmarc.yourdomain, though some interfaces want only _dmarc and append the domain themselves. The note under the output says so. Paste the generated value exactly, semicolons included. There must be one DMARC record at that name and no more.
If the External report authorization card lists a record, it belongs in the DNS of the receiving domain, not yours. Once both are live, follow the link to the DMARC Checker, which reads the record back, parses every tag and confirms whether each external destination is authorized.
- Host _dmarc (or _dmarc.yourdomain), type TXT, value the generated record.
- One DMARC record per name. A second one makes receivers ignore both.
- Subdomains without a record of their own inherit this one through sp.
What the generator cannot check
It validates the shape of each address, not whether the mailbox exists or can cope with the volume. Reports arrive daily from every receiver that saw your mail, so a personal inbox fills quickly. Use a dedicated address or a report service.
It does not look up your current record, your SPF or your DKIM keys, and it cannot tell whether your mail will pass once the policy is enforced. The checker and the report analyzer cover those, and the SPF Checker and DKIM Checker cover the two mechanisms DMARC depends on.