Where does this record go?

In your domain's DNS zone, wherever it is hosted: OVH, Gandi, IONOS, Cloudflare, your registrar. Neither Google nor Microsoft will do it for you, even though they run your mail.

Can I put a Gmail address in rua?

Technically yes, but use an address on your own domain instead. An external domain has to publish a DNS authorisation to receive your reports, and many providers stop sending them when it is missing.

Should ruf be enabled?

We do not. Few providers send these reports, they add little next to the aggregate ones, and they can contain headers from real messages, meaning personal data you then have to justify holding.

Does the tool check my domain?

No, deliberately: nothing you type here leaves your browser. To read what is actually published on your domain, use the domain checker, which is a separate tool.

Free tool

DMARC record generator

This tool composes a valid DMARC record from your answers and explains every tag it writes. It deliberately omits tags left at their default value: a record carrying adkim=r, aspf=r and pct=100 says exactly what a record without them says.

The record to publish

Enter your domain name.
Without a reporting address you will never know what is being sent in your name, and you will not be able to leave monitoring on any informed basis.

Name / subdomain: _dmarc
Type: TXT
Value: v=DMARC1; p=none;

What each part says

v: The version of the standard. Required, always this value, always first.
p: The main instruction: what receiving servers should do with messages that fail.

Everything is computed in your browser. Nothing you type here, neither domain nor address, is sent to a server, ours or anyone else's.

Before publishing what you have just composed

A DMARC record does nothing on its own: it rests on SPF and DKIM. If neither is correctly aligned with your domain, publishing a rejection policy blocks your own mail.

If your domain sends no email, publish p=reject immediately, with an empty SPF record. There is nothing legitimate to break.
If it does send, start at p=none with a reporting address, for two to four weeks.
Only tighten once every legitimate sender is identified and aligned. The procedure is in the guide on moving to rejection.

Why this record is shorter than the others

Most generators write every tag, including those left at their default. A record carrying adkim=r; aspf=r; pct=100; fo=0 says exactly what a record without them says: those are the values the standard applies in their absence.

Every superfluous tag is one more thing to misread for whoever inherits the domain in three years, and one more chance to leave a value you thought you had changed. This tool writes only what has an effect.