> ## Documentation Index
> Fetch the complete documentation index at: https://docs.dmarceye.com/llms.txt
> Use this file to discover all available pages before exploring further.
# DMARC Configurator
> A four-step wizard that reads your current DNS, then builds a DMARC, SPF, DKIM, or BIMI record you can publish.
Despite the name, this wizard is not limited to DMARC. Step two lets you configure SPF, DKIM, or BIMI as well.
## Where to find it
Select **DNS Tools** in the left navigation. **DMARC Configurator** is the first tab.
## The four steps
A progress bar tracks you through **Enter Domain → Select Change → Configure → Instructions**. **Back** returns to the previous step without losing what you have entered.
### Step 1 — Enter Domain
Type the domain you want to configure and select **Continue**.
### Step 2 — Select Change
The wizard reads your live DNS and shows what it found before you change anything:
* **The detected DNS provider**, shown beside the domain name — for example Amazon Route 53.
* **Nameservers**, so you can confirm you are about to edit the right zone.
* **Where to edit DNS** — the exact path inside that provider's console, for example `AWS Console → Route 53 → Hosted Zones`.
* **DNS Records**, an expandable list of every record on the domain, with a count.
Then choose one of four things to configure:
| Option | What it covers |
| ------------------------ | ----------------------------------------------------- |
| DMARC Policy & Reporting | Policy, alignment, and where reports are delivered |
| SPF Configuration | Which senders are authorised to send as your domain |
| DKIM Setup | Email signing for your domain |
| BIMI Logo | Displaying your brand logo in supported email clients |
### Step 3 — Configure
Every option uses the same three-column layout: **Element**, **Current Setup**, and **New Configuration**. Your existing values sit beside the fields you are editing, so you can always see what you are changing from. **Reset to Original** discards your edits and restores the current live values.
Select **Generate Record** when you are done. On DKIM and BIMI the button stays inactive until the required fields are filled.
| Element | What it controls |
| ------------------------- | -------------------------------------------------------------------------------------------------------------------- |
| Policy (`p`) | What happens to mail that fails authentication: `none` monitors only, `quarantine` sends to spam, `reject` blocks it |
| Subdomain Policy (`sp`) | A separate policy for subdomains. Left unset, subdomains inherit the main domain policy |
| Percentage (`pct`) | A slider setting the share of mail the policy applies to |
| DKIM Alignment (`adkim`) | Relaxed allows subdomain matches, Strict requires an exact domain match |
| SPF Alignment (`aspf`) | Relaxed allows subdomain matches, Strict requires an exact domain match |
| Report Interval (`ri`) | How often aggregate reports are sent. The default is 86400 seconds, or 24 hours |
| Failure Options (`fo`) | When forensic reports are generated |
| Aggregate Reports (`rua`) | Addresses that receive summary reports. Add and remove them individually |
| Forensic Reports (`ruf`) | Addresses that receive detailed reports on individual failures |
DMARCbis, published in May 2026, removes both `pct` and `ri` from the specification. Both fields still work with receivers today, but neither is a long-term way to control rollout.
| Element | What it controls |
| --------------- | ------------------------------------------------------------------------------------------------------- |
| Include Domains | Providers whose SPF records are pulled into yours. Enter them without the `include:` prefix |
| IP Addresses | Individual addresses authorised to send for your domain. Enter them without the `ip4:` or `ip6:` prefix |
| Mechanisms | Checkboxes to add the domain's own A record (`a`) or MX records (`mx`) |
| Default Policy | What happens to mail from senders not listed: `-all` rejects, `~all` marks suspicious |
Each list has **Add another** to append an entry and a remove control on each row.
SPF permits a maximum of ten DNS lookups. Every include you add consumes at least one. Check the count on the [SPF Checker](/spf-checker) after publishing.
| Element | What it controls |
| --------------------- | ------------------------------------------------------------------------------------------- |
| Selector | The identifier this key is published under, for example `google`, `selector1`, or `default` |
| DKIM Version (`v`) | The protocol version that identifies the record as DKIM |
| Key Type (`k`) | The cryptographic key type used for signing |
| Hash Algorithms (`h`) | Which hash algorithms are permitted for signatures |
| Public Key | The public half of your key pair, pasted without headers |
Your email service generates the key pair and gives you the public key and selector. Existing keys are hidden in the Current Setup column rather than displayed.
| Element | What it controls |
| --------------------- | ----------------------------------------------------------------------- |
| Logo URL (`l`) | Your logo in SVG format, publicly reachable over HTTPS |
| VMC Certificate (`a`) | Your Verified Mark Certificate. Gmail requires one to display your logo |
BIMI also requires DMARC at `p=quarantine` or `p=reject`. See the [BIMI Checker](/bimi-checker) for the full checklist.
### Step 4 — Instructions
The final step compares what you built against what is already published, then tells you how to apply it.
**Current DNS Record** shows the record as it stands today, named by type and host — for example `TXT record at _dmarc.yourdomain.com`.
**New DNS Record** gives you the record to publish, split into the two fields your DNS provider will ask for:
| Field | Example |
| ----- | -------------------------------------------------------------------------------------- |
| Name | `_dmarc` |
| Value | `v=DMARC1; p=quarantine; sp=quarantine; rua=mailto:…; adkim=r; aspf=r; ri=43200; fo=1` |
**Copy** puts the value on your clipboard.
**Changes Applied** lists every tag you altered, with the old value struck through beside the new one — for example `Subdomain (sp): inherit → quarantine`, or `Report Interval (ri): not set → 43200s`. Read this before publishing: it is the clearest confirmation that you are changing what you intended and nothing else.
**How to Apply This Change** then walks through publishing:
Includes a direct link to your provider's console, using the provider detected in step two.
Named "DNS", "DNS Settings", "Zone Editor", or "DNS Records" depending on the provider.
Replace the **entire** record with the new value rather than appending to it. The generated record already preserves your existing settings alongside the changes, so a partial edit risks losing tags. The Type and Name are restated here.
DNS changes can take up to 24 to 48 hours to propagate worldwide.
If your new configuration turns out to be identical to the live one, you get a **No Changes Detected** panel instead and there is nothing to publish. That is the expected result when you open the wizard to review a domain rather than change it.
**Back** returns to Configure so you can revise your settings. **Start Over** restarts from Enter Domain.
If your DNS runs on a supported provider, you may be able to skip manual publishing. See [One-click DNS setup](/one-click-dns-setup).