DMARC Record Generator

The 30-60-90 DMARC Rollout

DMARC is not a "publish once and forget" record. The correct rollout takes 90 days minimum to avoid blocking legitimate mail you forgot to authenticate.

• Days 1-30 - Monitor (p=none)
  Publish DMARC at p=none with rua= reporting. Collect aggregate reports. Identify every legitimate sender - ESP, transactional service, monitoring tool, calendar invites, vendor notifications. Fix any with broken SPF/DKIM alignment.
• Days 30-60 - Quarantine ramp (p=quarantine)
  Move to p=quarantine; pct=25. Watch reports daily for legitimate mail being quarantined. Slowly ramp pct to 100 over 30 days.
• Days 60-90 - Reject ramp (p=reject)
  Move to p=reject; pct=25, then 50, 75, 100. By day 90, spammers can no longer spoof your domain at compliant receivers.

Why You Need a Report Parser

Receivers send raw XML reports to your rua= address. Reading them manually is painful - they're verbose, count tens of thousands of records per day for active senders. Use a free parser:

• Postmark DMARC Weekly Digest - free, beautiful weekly summary email
• dmarcian - free tier covers basic dashboards
• EasyDMARC - free tier with 14-day data retention
• Valimail Monitor - free for small senders

Alignment - The Subtle Detail That Breaks DMARC

DMARC passes if EITHER SPF or DKIM passes WITH ALIGNMENT. Alignment means the From-domain matches the domain that authenticated.

• SPF alignment: the From-domain matches the MAIL FROM (Return-Path) domain
• DKIM alignment: the From-domain matches the d= tag in the DKIM signature

Common breakage: you send via SendGrid with From: [email protected], but SendGrid uses MAIL FROM: [email protected]. SPF passes (sendgrid.net SPF is fine), but alignment fails (sendgrid.net ≠ yourdomain.com). DMARC fails unless DKIM aligns. Fix: configure custom DKIM at SendGrid using d=yourdomain.com.