APRF Record Generator
Build the APRF TXT record that asks mailbox providers for daily inbox placement reports: pick every selector or one, add report addresses and an optional SDI header, and get the authorization record any external address needs.
Where providers email the daily reports. An address outside your domain needs an authorization record on its own domain, printed below.
Enter your signing domain and at least one report address to get the record.
How to publish an APRF record
An APRF record tells mailbox providers that support Aggregate Performance Reporting where to email their daily reports for your DKIM signing domain. It is one TXT record with two required tags, defined in draft-ietf-mailmaint-aprf-00:
*._aprf._domainkey.example.com TXT "v=APRFv1; rua=mailto:aprf@example.com"
Publish it under the domain in your DKIM signatures (the d=
value), which is often not your From domain when an email service signs
for you. The DKIM checker shows which
selectors your domain publishes.
Every selector or one
The wildcard *._aprf._domainkey covers every selector,
including the ones email services create and rotate on their own, so most
senders need only that one record. A record for one selector, such as
s1._aprf._domainkey, takes precedence for that selector: use
it to send one mail stream's reports to a different address. The
selector-less _aprf._domainkey name also covers every
selector, and receivers check it last.
Optional: split reports with SDI
The sdi= tag names a header your mail carries, plus the one
character that separates its parts, for example
sdi=X-Stream-Info,^ with a header value of
Marketing^Newsletter^October. A provider may then report
counts per segment, up to four parts deep. The header must be covered by
your DKIM signature, providers may ignore the request, and segment names
can appear in reports, so keep them free of anything sensitive.
Report addresses on another domain
Providers should only send reports to an address outside your domain if
that domain agrees to receive them. The generator prints the TXT record
the receiving domain publishes for that. DMARCguard collects APRF reports,
and its report addresses on reports.dmarcguard.io already
publish this authorization, so you can list your DMARCguard report address
without asking anyone for DNS changes.
After publishing, confirm the record with the APRF record checker.
Read the complete APRF guide to learn more.
Frequently asked questions
Should I publish a wildcard or a per-selector APRF record?
Most senders need only the wildcard, *._aprf._domainkey.<domain>: it covers every selector, including ones an email service rotates without telling you. Add a per-selector record when one mail stream's reports should go to a different address; it takes precedence over the wildcard for that selector.
What does the sdi tag do?
sdi= names a DKIM-signed header and a separator character, such as sdi=X-Stream-Info,^. A provider may then split its counts by the parts of that header, up to four deep. It is optional, providers may ignore it, and segment names can appear in reports.
Does APRF need DMARC?
No. APRF is keyed to DKIM: a provider looks the record up from the d= domain and selector of a valid DKIM signature, so mail must be DKIM-signed for reports to exist. DMARC remains the protocol that protects your From domain from spoofing.
Get the full picture with DMARCguard
Continuous monitoring, aggregate report parsing, and actionable insights for all your email authentication protocols.
Start Free