DMARC Record Generator

Generate a DMARC TXT record for your DNS settings.

RFC 9989

Your domain name

Enter the domain only, such as example.ca. Do not include https:// or _dmarc.

Record options

Policy p i

Monitor first while you identify legitimate senders.

Subdomain policy sp i

DKIM alignment adkim i

SPF alignment aspf i

Report address rua i

Non-existent subdomains np i

Failure report address ruf i

Failure option fo i

Test mode t=y Useful while testing a quarantine or reject policy. The older percentage tag is not generated.

DNS settings: add this to your domain

Field	Value	Action
Type	TXT
Host	—
Answer	v=DMARC1; p=none;
TTL	3600 or provider default

Monitoring policy: Messages that fail DMARC are not subject to an enforcement request. Use aggregate reports to review your legitimate senders before moving to quarantine or reject.

Canadian Business Email

DMARC for a .ca domain or Canadian business

A .ca domain uses the same DMARC standard as other domain names. A business using example.ca would normally publish its policy at _dmarc.example.ca.

DMARC matters when customers rely on your domain for invoices, order notices, password resets, support messages, newsletters, or other business email. SPF and DKIM provide authentication; DMARC adds alignment, policy, and reporting so you can better understand how your domain is being used.

If you are also planning where to host the website itself, the HostFinder Canadian web hosting guide compares Canadian-owned providers, local infrastructure, CAD pricing, WordPress hosting, and VPS options.

Common Questions

DMARC Record FAQ

Quick answers about DMARC policies, SPF and DKIM alignment, reports, .ca domains, and publishing your TXT record.

What does a DMARC record do?

DMARC tells receiving mail systems how your domain wants messages handled when they do not pass DMARC validation. It works with SPF and DKIM and checks whether an authenticated domain aligns with the domain people see in the From address.

DMARC adds policy, alignment, and reporting on top of SPF and DKIM.

Which DMARC policy should I use: none, quarantine, or reject?

For a new deployment, p=none is usually the safest place to start because it lets you collect reports without asking receivers to change normal handling. After you identify legitimate senders and confirm SPF or DKIM alignment, you can move to quarantine and eventually reject when you are ready to enforce the policy.

Start by monitoring your mail, then move to enforcement after legitimate senders are aligned.

Do I need SPF and DKIM before adding DMARC?

You should configure SPF and DKIM for your legitimate sending services before enforcing DMARC. A message can pass DMARC when at least one supported authentication method passes and its authenticated identifier aligns with the visible From domain.

DMARC depends on aligned SPF and/or DKIM authentication.

What does relaxed or strict alignment mean?

Relaxed alignment allows the authenticated domain and the visible From domain to share the same organizational domain. Strict alignment requires an exact domain match. Relaxed alignment is the practical default for most domains.

Relaxed alignment is the usual starting point; strict alignment requires an exact domain match.

What is the aggregate report address (rua)?

The rua tag tells participating receivers where to send aggregate DMARC reports. These reports can help you identify which systems are sending mail using your domain and whether those messages are passing SPF, DKIM, and DMARC.

Aggregate reports are useful for discovering legitimate and unauthorized senders using your domain.

What are DMARC failure reports (ruf)?

The optional ruf tag requests failure reports for individual authentication failures. They can help with troubleshooting, but they may contain message-specific information and many receivers do not send them. Use failure reporting only if you understand the privacy and handling implications.

Failure reports can contain sensitive message information and are not universally sent.

Does DMARC work differently for a .ca domain?

No. DMARC works the same way for a .ca domain as it does for other domain names. A Canadian business using example.ca would normally publish its policy as a TXT record at _dmarc.example.ca. There is no special .ca-only DMARC policy.

A .ca domain uses the same DMARC standard; the record normally lives at _dmarc.yourdomain.ca.

Why is DMARC important for a Canadian business website?

If your business sends invoices, order notices, account messages, password resets, newsletters, or support email from its own domain, attackers may try to impersonate that domain. DMARC gives you reporting and policy controls that can reduce successful domain spoofing when SPF and DKIM are configured correctly. Email security is one part of the broader setup covered in the HostFinder Canadian web hosting guide.

Protecting the domain customers recognize can help reduce convincing email impersonation.

Where do I publish the DMARC record?

Publish DMARC as a DNS TXT record under the _dmarc label. For example, the record for example.ca is published at _dmarc.example.ca. Some DNS providers want the full host name, while others want only _dmarc because they append the domain automatically.

DMARC is a DNS TXT record published under the _dmarc label.