DMARC record generator
Answer a few questions and get a correct, ready-to-publish DMARC TXT record — plus the rollout plan to go from monitoring to full protection.
- Runs entirely in your browser
- Nothing you type is sent anywhere
- Free, no signup
1 · Policy — what should receivers do with failing mail?
2 · Reporting — where should the reports go?
Daily XML summaries of everyone sending as your domain. Strongly recommended — without rua you get no feedback at all.
Per-message failure samples. Privacy caveat: these can contain full message content including personal data, so many receivers no longer send them. Leave empty unless you know you need it.
3 · Tuning — safe to leave on the defaults
How much failing mail the policy applies to. Has no effect at p=none — there's no action to throttle.
Policy for subdomains like mail.yourdomain.com. A weaker sp than p leaves a spoofing loophole.
DKIM alignment (adkim)
Relaxed (default) lets subdomains sign for the parent domain; strict requires an exact match.
SPF alignment (aspf)
Relaxed (default) accepts a Return-Path on a subdomain; strict requires an exact match.
Your DNS record — updates as you type
Type
TXT
Host / Name
_dmarcMost DNS panels append your domain automatically — the full name becomes _dmarc.yourdomain.com. If yours wants the full name, type it out.
Value
v=DMARC1; p=noneTip: add an aggregate report address above — a DMARC record without rua gives you zero visibility.
Built entirely in your browser — this page makes no network requests and stores nothing.
How it works
From form to published policy
01
Pick a policy
Start with p=none and a reporting address — it changes nothing about delivery and starts the feedback loop.
02
Copy the record
The host and value fields update live as you type, including only the tags that differ from the defaults.
03
Publish and verify
Add it as a TXT record at your DNS host, then confirm it resolves with our DMARC record checker.
How to publish this record
- 01
Log in to your DNS host — usually your domain registrar (Cloudflare, Namecheap, GoDaddy, Route 53, …).
- 02
Open the DNS records for your domain and add a new TXT record.
- 03
Set the host / name to _dmarc — most panels append your domain automatically, making it _dmarc.yourdomain.com.
- 04
Paste the generated value from above into the record's content field and save.
- 05
Wait for propagation (minutes to an hour), then verify it with our DMARC record checker.
Once it's live, confirm it with the DMARC record checker.
The recommended rollout path
- 01
Start with p=none and a rua address — nothing about delivery changes, but reports start arriving.
- 02
Read the reports for a few weeks (our DMARC report viewer makes the XML readable) and fix any legitimate sender that fails alignment.
- 03
Move to p=quarantine with pct=25 — a quarter of failing mail goes to spam while you keep watching.
- 04
Raise pct to 100, then ratchet to p=reject. Your domain is now fully protected against spoofing.
The reports arrive as compressed XML — the DMARC report viewer turns them into a readable table. And since DMARC leans on SPF and DKIM, make sure your SPF record and DKIM keys are healthy first.
FAQ
What's a safe starting DMARC record?
v=DMARC1; p=none; rua=mailto:[email protected] — exactly what this generator produces with the defaults. It changes nothing about delivery, turns on aggregate reporting, and satisfies Gmail's and Yahoo's baseline DMARC requirement for bulk senders.
Will publishing a DMARC record break my email?
Not at p=none — it changes nothing about how any mail is delivered; it only asks receivers to start sending you reports. Delivery is only affected once you move the policy to quarantine or reject, which you should do only after your reports show all legitimate mail passing.
Where do the reports arrive, and what do they look like?
Each participating receiver — Google, Microsoft, Yahoo, and most others — emails a compressed XML file, usually once a day, to your rua address. It lists every IP that sent mail claiming your domain, with volumes and SPF/DKIM results, but no message content. Open them with our DMARC report viewer to see them as a readable table.
When should I move from none to quarantine or reject?
After a few weeks of reports show every legitimate source passing with alignment. Move to quarantine — pct=25 lets you ease in on a quarter of failing mail — then raise pct to 100, then switch to reject. At each step keep reading reports, and roll back if legitimate mail starts failing.
Do I need a paid DMARC analytics service?
Not to get started. Publish p=none with rua pointing at a mailbox you control and read the XML reports with our free DMARC report viewer. Dedicated services add trend dashboards and alerting, which become valuable at higher volume — but nothing stops you starting for free today.