DMARC policy generator

Tells receivers what to do with email that fails DMARC. none = monitoring only (no quarantine/reject). quarantine = treat as suspicious (e.g. spam folder). reject = reject the message. Start with none, then move to quarantine or reject once you trust your reports.

Same as p= but applies to subdomains (e.g. mail.example.com). Often set to none while you enforce p= on the main domain, so subdomains are only monitored.

Email addresses (mailto:) that receive daily aggregate reports in XML. Reports summarize authentication results (SPF/DKIM/DMARC) for your domain. Use a dedicated address (e.g. [email protected]) or a third-party aggregator.

Email addresses for forensic (per-message) reports when a message fails. Not all providers send forensic reports. Optional; rua is more commonly used.

r (relaxed): Organizational domain can match (e.g. mail.example.com and example.com). s (strict): Exact domain match required. Relaxed is recommended for most setups.

Same as adkim but for SPF. r = relaxed, s = strict. Relaxed is typical.

When to request forensic reports: 0 = if any check fails; 1 = if all fail; d = DMARC failure only; s = SPF or DKIM failure. 0 is common.

Percentage of failing messages to which the policy (p=) applies. 100 = all. Use a lower value (e.g. 10) to roll out enforcement gradually and avoid blocking legitimate mail.