What is the pct tag in DMARC?

pct is the percentage of failing messages the policy applies to. pct=100 means the policy applies to all failing messages. pct=25 means only 25% are affected (useful for gradual rollout of p=quarantine or p=reject).

What is a rua address?

rua is the mailbox that receives DMARC aggregate reports — XML-formatted daily summaries of authentication results from participating receivers. Format: rua=mailto:dmarc-reports@yourdomain.com. Most teams use a free aggregator (Postmark, dmarcian, URIports) that parses the XML into a readable dashboard.

What is the difference between rua and ruf?

rua is aggregate reports — daily XML summaries showing pass/fail counts by IP. ruf is forensic reports — individual failing messages sent back in real time. Most receivers no longer send ruf reports for privacy reasons, so you can skip it. Always include rua.

What does DMARC alignment mean?

DMARC alignment means the 'From' header domain matches the authenticating domain in SPF or DKIM. Relaxed alignment (default) allows subdomain matches (newsletter.example.com aligns with example.com). Strict alignment requires exact match. Use relaxed (default) for cold email — strict breaks if you use subdomains.

How do I check my DMARC record?

Use the DMARC Checker on this page — enter your domain and we look up the TXT record at _dmarc.yourdomain.com via Google Public DNS, then score the policy strength. Or from a terminal: dig TXT _dmarc.example.com +short.

Can I have a DMARC record without SPF or DKIM?

Technically yes, but the policy will have no effect — DMARC works by requiring SPF or DKIM to pass and align with the From domain. Without at least one of them, every message fails DMARC. Always publish SPF and DKIM before enabling DMARC enforcement.

Free DMARC Record Generator & Checker for Cold Email (2026)

TL;DR

A DMARC record is a DNS TXT record at _dmarc.yourdomain.com that tells receiving mail servers what to do with messages that fail SPF or DKIM. A correct starter DMARC record is v=DMARC1; p=none; rua=mailto:reports@yourdomain.com. Move to p=quarantine after 2-4 weeks of monitoring, then p=reject once all legitimate senders align. Use the generator below.

DMARC Generator

Pick your policy, rollout %, and reporting addresses on the left. The TXT record updates live on the right.

Policy p

noneMonitor

quarantineSpam

rejectBlock

Rollout pct: 100%

1%100%

Aggregate reports rua

Forensic reports ruf — optional

Advanced

Subdomain sp

DKIM adkim

SPF aspf

Your DMARC record

Publish as DNS TXT at _dmarc.yourdomain.com

v=DMARC1; p=none

Policy strength15/100

Monitor only — start here, then tighten.

DMARC Checker

Domain to check:

What Is DMARC?

DMARC (Domain-based Message Authentication, Reporting, and Conformance, defined in RFC 7489) is the third leg of the cold email authentication trio. It does two things: (1) tells receiving mail servers what to do when a message fails both SPF and DKIM alignment with your From domain, and (2) asks receivers to send reports about authentication results so you can see what's happening in the wild.

DMARC requires SPF OR DKIM to pass AND align with the From domain. Without SPF or DKIM published, DMARC has no effect — every message fails. Always publish SPF and DKIM first.

Safe Rollout Path

Jumping straight to p=reject on a live domain will block every forgotten sender you didn't realize existed. Use this rollout:

Week 1-2: Publish v=DMARC1; p=none; rua=mailto:reports@yourdomain.com. Review aggregate reports daily. Add any legitimate senders you find to SPF and/or configure DKIM for them.
Week 3-4: Move to p=quarantine; pct=25. Watch reports for 1-2 weeks. If no legitimate mail is quarantined, step up to pct=50, then pct=100.
Week 5+: Move to p=reject; pct=100. This is the strongest protection and what Google/Yahoo prefer for bulk senders.

How to Publish Your DMARC Record

Copy the generated record from the box above.
Log in to your DNS host.
Create a new TXT record with host/name _dmarc (NOT the root — DMARC uses the _dmarc subdomain).
Paste the generated value. Leave TTL at 3600 or the default.
Save. Wait 1-15 minutes for propagation, then verify with the checker above.

Tag Reference

Tag	Purpose	Example
`v`	Version (required, always `DMARC1`)	`v=DMARC1`
`p`	Policy for failing messages	`p=quarantine`
`pct`	Percent of failing messages to apply policy to (1-100)	`pct=50`
`rua`	Aggregate report mailbox (daily XML summaries)	`rua=mailto:reports@example.com`
`ruf`	Forensic report mailbox (rarely used in 2026)	`ruf=mailto:forensics@example.com`
`sp`	Policy for subdomains (defaults to `p`)	`sp=reject`
`adkim`	DKIM alignment: `r` (relaxed) or `s` (strict)	`adkim=r`
`aspf`	SPF alignment: `r` (relaxed) or `s` (strict)	`aspf=r`

Next up: Pair DMARC with SPF and DKIM. All three are required in 2026.

Frequently Asked Questions

What is a DMARC record?

DMARC is a DNS TXT record at _dmarc.yourdomain.com that tells receivers what to do with messages that fail SPF or DKIM. A DMARC record looks like v=DMARC1; p=quarantine; pct=100; rua=mailto:reports@yourdomain.com.

Do I need DMARC for cold email?

Yes. Since February 2024, Google and Yahoo require DMARC on any domain sending more than 5,000 messages per day. Cold email without DMARC lands in spam at 2x the rate of authenticated email.

What is the difference between `p=none`, `p=quarantine`, and `p=reject`?

p=none is monitor-only. p=quarantine sends failing messages to spam. p=reject blocks them outright. Start at none, move to quarantine after 2-4 weeks, then reject.

What is the `pct` tag?

The percentage of failing messages the policy applies to. pct=25 means 25% of failing messages get quarantined or rejected — useful for gradual rollout.

What is `rua`?

The mailbox that receives DMARC aggregate reports. Format: rua=mailto:reports@yourdomain.com. Use a free aggregator (Postmark, dmarcian, URIports) to parse the XML into a dashboard.

Does Winnr set up DMARC automatically?

Yes. Every Winnr-provisioned domain gets SPF, DKIM, and DMARC configured automatically.

Can I have DMARC without SPF or DKIM?

Technically yes, but every message will fail — DMARC requires SPF or DKIM to pass first. Always publish SPF and DKIM before enforcing DMARC.

Related tools: SPF Record Generator · DKIM Record Generator · Inbox Calculator. Related reading: Cold Email DNS Setup Checklist.