Skip to content
newsletter-marketing24.deLaw · Deliverability · Metrics

Last reviewed:

Translated from German; if the versions differ, the German version applies.

DMARC builder

The DMARC builder puts together a DMARC record under RFC 9989 from a few selection fields – the TXT record under _dmarc. of your sender domain – and explains every option you choose. It is meant for anyone who wants to set up DMARC for their newsletter domain or understand an existing record.

What DMARC specifies

DMARC (Domain-based Message Authentication, Reporting and Conformance) checks whether the visible sender address matches a passed SPF or DKIM check. This match is called alignment. The record also tells recipients what to do if the check fails: observe (p=none), treat as suspicious (p=quarantine) or reject (p=reject).

Since May 2026 the governing standard has been RFC 9989. Alignment is either relaxed (same organisational domain) or strict (identical domain); relaxed is the default. sp applies to existing subdomains, np to non-existent ones. If np is missing, sp applies; if sp is missing as well, p applies. The former percentage switch pct has been dropped; the test mode t takes its place.

How to use it

  1. Enter your sender domain, i.e. the domain after the @ of the sender address.
  2. Choose the policy. For getting started, RFC 9989 describes p=none with a report address (Sections 5.1.4 to 5.1.7).
  3. Enter an address for the aggregate reports under rua. Only change the other options if you need them.
  4. Copy the record and create it at your DNS provider as a TXT record under the name shown.

The builder

Options

Policy (p)
DKIM alignment (adkim)
SPF alignment (aspf)
Test mode (t)

TXT record for _dmarc.your-domain.de

v=DMARC1; p=none

    According to RFC 9989 (May 2026). The former switch pct has been dropped; it is replaced by the test mode t. The tool does not check anything live – the DMARC reports show whether the record works.

    What the builder does not check

    • Whether the record is in the DNS. The builder does not query the DNS. Whether the record has been published and takes effect is shown by the DMARC reports or your DNS provider.
    • Whether SPF and DKIM are set up. DMARC builds on a passed and aligned SPF or DKIM check. Whether your sending platform is set up that way, the builder cannot see.
    • All tags. It sets v, p, sp, np, adkim, aspf, t and rua. It does not offer the tags fo, ruf and psd from RFC 9989.
    • Report addresses in other domains. If the rua address is not in the domain being reported on, RFC 9989 requires an additional procedure (Section 11.6, with a reference to RFC 9990). The builder does not set this up.
    • An existing record. If there already is a DMARC record, replace it. Several DMARC records for the same target are all discarded (RFC 9989, Section 4.10).

    Frequently asked questions

    What does p=none do? Recipients are not asked to do anything special if the check fails. With a report address you still find out which servers send email in your name and whether they pass SPF and DKIM.

    Why does the builder not offer pct? RFC 9989 has removed the tag pct. The test mode t takes its place: t=y corresponds to the former pct=0, t=n to the former pct=100. You will still find pct in guides based on the older version, RFC 7489.

    Is my domain looked up or stored anywhere? No. The builder runs only in your browser, sends nothing and does not query the DNS.

    Further reading