DMARC record generator

What each tag actually does

p= is the whole point: it tells receivers what to do with mail that claims to be from you and fails both SPF and DKIM alignment. none does nothing except generate reports. quarantine sends it to spam. reject refuses it at the SMTP conversation, so it never reaches the recipient at all.

rua= is where the daily aggregate reports go. They are XML, they are ugly, and they are the only way to find out which of your own senders are failing before you turn enforcement on. A DMARC record without rua is a policy you cannot see the effect of.

sp= covers subdomains. It is worth setting to reject early even while the parent domain sits at none, because attackers spoof subdomains you have never used and you lose nothing by refusing mail from them.

adkim= and aspf= control how exactly the authenticated domain must match the From address. Relaxed allows a subdomain to satisfy alignment, which is what most sending services need.

The order that works

1. Publish with p=none and a real rua address.
2. Read the reports for two weeks. You will find senders you forgot about.
3. Fix them, then move to p=quarantine.
4. When the reports are clean, move to p=reject.

We ran our own domain at p=quarantine for weeks and only advanced to reject after checking that every aggregate report showed full alignment for every legitimate sender. That is the boring path and it is the one that does not lose you mail. The reasoning is in what DMARC does, and you can check what your domain publishes today with the email setup checker.