DMARC Record Generator
DMARC record generator: build a valid DMARC record with policy and reports Free, no sign-up, and it runs in your browser.
Dedicated page: /en/dmarc-generator
Report an Issue
Found a mistake or a problem with this tool? Tell us below.
Quick answer
A DMARC record generator builds the DMARC policy (Domain-based Message Authentication, Reporting and Conformance) that tells receivers what to do when email from your domain fails SPF or DKIM checks: monitor with p=none, quarantine, or reject, and where to send reports.
About this DMARC Record Generator
DMARC record generator: build a valid DMARC record with policy and reports It is one of the Security and DNS on ToolUstad, and like every tool here it runs entirely in your browser: nothing you type, paste or open is uploaded to a server, and there is no sign-up or usage limit.
What is DMARC?
DMARC builds on SPF and DKIM and adds two things they lack: alignment and a policy. Alignment means the domain in the visible From header must match the domain that SPF or DKIM authenticated. The policy, the p tag, tells receivers what to do when both checks fail: p=none monitors only, p=quarantine sends failures to spam, and p=reject refuses them outright. You publish the record as a TXT record at _dmarc.yourdomain.com.
The tags that matter
| Tag | Purpose | Example |
|---|---|---|
| v=DMARC1 | Version, always first | v=DMARC1 |
| p | Policy for failing mail | p=reject |
| pct | Percentage of mail the policy applies to | pct=100 |
| rua | Where aggregate reports go | rua=mailto:[email protected] |
| ruf | Where forensic failure reports go | ruf=mailto:[email protected] |
| adkim / aspf | Alignment strictness, relaxed or strict | adkim=r; aspf=r |
| sp | Policy for subdomains | sp=reject |
How to roll DMARC out safely
- Start at p=none with an rua address, and read the aggregate reports for two to four weeks.
- Fix every legitimate sender the reports reveal until all real mail passes aligned SPF or DKIM.
- Move to p=quarantine, optionally with a rising pct value, and keep watching reports.
- Finish at p=reject so spoofed mail using your exact domain is refused at the door.
Best practices
- Send reports to a dedicated mailbox or a DMARC reporting service: raw XML is unreadable at volume.
- Set an sp policy so subdomains are not left as the soft target.
- Only one DMARC record per domain, published at the _dmarc subdomain.
Common mistakes to avoid
- Jumping straight to p=reject before inventorying senders, and blocking your own invoices.
- Publishing the record at the root domain instead of _dmarc.
- Setting p=none and forgetting it forever: monitoring without enforcement stops nothing.
- Expecting DMARC to fix spam folder placement for mail that passes: it stops spoofing, not filtering.
Who is the DMARC generator for?
Business owners protecting their brand from spoofing, email marketers meeting Google and Yahoo sender requirements, and IT administrators rolling out authentication. The record is one line of text, but the tag order and syntax matter, and a generator removes the guesswork while explaining what each policy choice will actually do to your mail.
What the aggregate reports actually tell you
The rua reports arrive as XML files from every major receiver, daily, listing each sending source IP, the volume, and the SPF and DKIM alignment results for your domain. In the first week they almost always reveal surprises: a forgotten CRM, the website contact form sending as the root domain, a marketing tool nobody documented. That discovery phase is the real value of p=none. Once every legitimate source passes aligned authentication for a full reporting cycle, tightening to quarantine and then reject is a formality, and your domain stops being usable for exact domain phishing.
Learn: how to use the DMARC Record Generator
- Enter your domain and set the policy to none. Monitor mode plus an rua report address is the correct first DMARC record for almost everyone.
- Add the email address that should receive aggregate reports. Read the explanation under the record so you know what each tag does.
- Publish the TXT record at _dmarc.yourdomain, watch reports for a few weeks, then step up to quarantine and finally reject, using pct to roll out gradually.
Features
- Policy (p) and subdomain policy (sp): none, quarantine or reject
- Percentage (pct) control for gradual enforcement rollouts
- rua aggregate and ruf forensic report addresses
- Relaxed or strict DKIM and SPF alignment (adkim, aspf), failure options (fo) and report interval (ri)
- Ready DNS TXT block at the _dmarc host name
- A plain-English explanation generated from your exact settings
Worked example
A standard first record, v=DMARC1; p=none; rua=mailto:[email protected]; adkim=r; aspf=r, changes nothing about delivery but starts the flow of reports that shows you every service sending as your domain.
Frequently asked questions
Do I need SPF and DKIM before DMARC?
DMARC passes when either SPF or DKIM passes AND aligns with the visible From domain. Publish SPF and DKIM first (see the SPF generator here), or DMARC will report failures on your own legitimate mail.
How long should I stay at p=none?
Until your aggregate reports show every legitimate sender passing with alignment, typically 2 to 4 weeks. Then quarantine at a low pct, then reject at 100%.
Where exactly does the record go?
As a TXT record at the host name _dmarc.yourdomain (for example _dmarc.example.com). There can only be one DMARC record per domain.
Why do bulk senders have to care now?
Google and Yahoo require SPF, DKIM and DMARC for anyone sending more than about 5,000 messages a day to their users, and Microsoft has followed. Without them, bulk mail is rejected or spam-foldered.
What is the difference between p=none, p=quarantine and p=reject?
p=none asks receivers only to report failures and deliver mail normally. p=quarantine tells them to treat failures as suspicious, usually spam folder. p=reject tells them to refuse the message during delivery. Move through them in that order.
Do I need SPF and DKIM before DMARC?
Yes, for DMARC to pass, a message needs aligned SPF or aligned DKIM, and both should be in place. Publishing DMARC with neither working means all your mail fails, which is useful at p=none for discovery, but dangerous at p=reject.
What is DMARC alignment?
Alignment compares the domain in the From header with the domains authenticated by SPF and DKIM. Relaxed alignment allows subdomains to match; strict alignment requires an exact match. Relaxed is the default and right for most senders.
Related tools
More Security and DNS like this one, plus two picks from other categories. Each opens its own dedicated page.