Unitpost

Generate a DMARC record

Pick a policy, then publish one TXT record.

One or more addresses, separated by commas.

Below 100 phases in quarantine or reject. Ignored for p=none.

Relaxed lets subdomains align with the main domain. Most senders want relaxed.

Your record

TXT _dmarc.example.com
v=DMARC1; p=none
p=none without a report address does nothing you can see. Add an address so you can watch who sends as you.

The record is built in your browser. Nothing you type is sent to Unitpost, and there's no sign-up.

A DMARC record is one TXT record at _dmarc.yourdomain, such as v=DMARC1; p=none; rua=mailto:dmarc@yourdomain. Choose a policy (none to monitor, quarantine to send failing mail to spam, reject to refuse it), a policy for subdomains, the share of failing mail it covers, the alignment mode and an address for aggregate reports. Start at p=none with a report address, and tighten once reports show every legitimate sender passing.

What each choice does

Each field sets one tag in the record. A field left at its default writes no tag, because receivers assume the default anyway.

FieldTagWhat it does
PolicypWhat receivers do with mail that fails DMARC: none delivers it and reports, quarantine sends it to spam, reject refuses it.
SubdomainsspThe policy for subdomains without a record of their own. Written only when it differs from the domain's policy.
Apply to this % of failing mailpctApplies the policy to a share of failing mail and treats the rest one step softer. Written only below 100. RFC 9989 removed this tag, so leave it at 100 unless you have a reason.
Alignmentadkim, aspfRelaxed passes when SPF or DKIM is for the same organizational domain as From, so mail.example.com aligns with example.com. Strict needs the exact domain. Written only for strict.
Send aggregate reports toruaWhere receivers send their aggregate reports of who sent mail as your domain and whether it passed. mailto: is added for you.

Pick relaxed alignment unless you know every sender uses your exact domain. Strict SPF alignment fails for any service that uses a return-path subdomain, Unitpost's unitpost.<your domain> included; DKIM still aligns there, because the signature uses your domain.

A safe record to start with

Start with monitoring and a report address. This record changes nothing about delivery and meets the minimum Gmail, Yahoo and Microsoft set for bulk senders:

TXT at _dmarc.example.com
v=DMARC1; p=none; rua=mailto:dmarc@example.com

When the reports show every legitimate source passing, publish v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com, and later p=reject. The order and what to look for are in rolling out DMARC. If you send through Unitpost, the domain page suggests v=DMARC1; p=none;; add a rua address to that to get reports.

Where to publish it

Add one TXT record named _dmarc on the domain in your From address, so it resolves at _dmarc.example.com.

  • Name or host: _dmarc. Most DNS editors add the domain for you; typing _dmarc.example.com there creates _dmarc.example.com.example.com.
  • Type: TXT. Value: the generated record. If your editor adds quotes itself, don't add your own.
  • One record only. A second v=DMARC1 record at the same name makes receivers apply no policy at all.
  • Subdomains are covered by this record unless they publish their own.

Then confirm what DNS serves, or run the DMARC checker:

Bash
dig TXT _dmarc.example.com +short

Frequently asked questions

What should my first DMARC record be?

`v=DMARC1; p=none; rua=mailto:dmarc@yourdomain`. It changes nothing about delivery and starts the reports you need before you enforce a policy.

Is p=none enough for Gmail and Yahoo?

For their bulk sender requirement, yes: both accept `p=none` as the minimum. It doesn't stop anyone from spoofing your domain; quarantine and reject do.

What address should I use for rua?

A mailbox that can take a steady flow of XML attachments, or a DMARC report service. An address on another domain only receives reports if that domain authorizes it.

Should I use strict or relaxed alignment?

Relaxed, in almost every case. Strict fails mail sent through services that use a return-path subdomain or sign for a parent domain, and adds little protection.

How long does a DMARC record take to work?

Receivers use it once their DNS caches pick it up, usually within the record's TTL. Aggregate reports usually cover a full day, so the first ones arrive a day or two later.

Go deeper: What Gmail, Yahoo and Microsoft require from DMARC · DMARC in the Unitpost docs · Sending domains in Unitpost

Free tools

Send from a domain that checks out

Unitpost sets up SPF, DKIM and DMARC with you and keeps checking them.

Start for freeExplore the docs