Free tool

DMARC Record Generator

Build a DMARC TXT record for your domain. Set your policy, add report addresses, and copy the record straight into your DNS.

English
The domain you want to publish a DMARC policy for.
Start with none to monitor reports, then tighten to quarantine and reject as you build confidence.
Aggregate report addresses rua Where do you want aggregate XML reports sent? Receivers email these every day with a summary of mail authenticated against your domain. You can add multiple addresses — paste a comma-separated list, or click + Add address.
Advanced options Subdomain policy, alignment, percentage, failure reports
Failure report addresses ruf Where do you want forensic per-message reports sent? Most large receivers (Gmail, Outlook) no longer send these — leave blank if unsure. Multiple addresses supported — paste a comma-separated list.
Override how subdomains are treated.
% of mail your policy applies to. Useful for staged rollouts.
SPF alignment aspf
DKIM alignment adkim
How often receivers send aggregate reports, in seconds. Default 86400 (24h).
Failure reporting options fo
Background

What is a DMARC record?

A DMARC record is a TXT entry you publish in your domain's DNS. It tells receiving mail servers what to do with messages that claim to come from your domain but fail SPF or DKIM authentication. The record also asks those receivers to send you reports on every authentication result, so you can see who is sending mail using your domain and whether it is reaching the inbox.

A minimal DMARC record looks like this:

v=DMARC1; p=none; rua=mailto:reports@yourdomain.com

Three things define what it does:

  • The version (v=DMARC1), which is always required.
  • The policy (p), which controls what receivers do with mail that fails authentication. Options are none, quarantine, or reject.
  • The reporting addresses (rua for daily aggregate summaries, and the optional ruf for forensic per-message data).

Every other tag is optional and lets you fine-tune the policy.

Step by step

How to create a DMARC record

This generator builds your record in three steps:

  1. Enter your sending domain

    This is the apex domain you send email from, for example yourdomain.com. The DMARC record applies to that domain and, by default, to its subdomains.

  2. Pick a policy

    Start with p=none to monitor authentication results without affecting delivery. Move to quarantine, then reject, after you have read your reports and confirmed that every legitimate sender is authenticated.

  3. Add reporting addresses

    At minimum, add an aggregate report mailbox so receivers can email you daily summaries. A failure report mailbox is optional and rarely populated by major providers.

Click Generate DMARC record to build the TXT entry, then copy it into your DNS.

Deployment

How to publish your DMARC record

You publish a DMARC record by adding a TXT entry to your domain's DNS. The hostname is always _dmarc.yourdomain.com, with your domain in place of yourdomain.com. The value is the record string this generator produces.

Steps vary slightly per DNS provider, but the shape is the same:

  1. Sign in to your DNS provider and open the DNS settings for your domain.

  2. Add a new record. Set the type to TXT.

  3. Set the host or name field to _dmarc. Most providers append the rest of your domain automatically.

  4. Paste the generated record into the value or content field.

  5. Save. DNS propagation typically completes within a few minutes, occasionally longer.

After publishing, allow 24 to 48 hours before your first reports start arriving. Once you have a few days of data, switch this generator to p=quarantine or p=reject and update your record.

Reference

DMARC tags explained

Tag Values Required Description
v DMARC1 Yes DMARC version. Always DMARC1. Must be the first tag.
p none, quarantine, reject Yes Policy receivers apply to mail that fails DMARC authentication.
rua mailto URI list No Where receivers send daily aggregate XML reports. Use commas to list multiple addresses.
ruf mailto URI list No Where receivers send forensic per-message reports. Most large providers no longer send these.
sp none, quarantine, reject No Subdomain policy. If omitted, subdomains inherit the value of p.
pct 0 to 100 No Percentage of failing mail your policy applies to. Defaults to 100. Useful for staged rollouts.
aspf r, s No SPF identifier alignment. Relaxed (r) is the default. Strict (s) requires an exact match between the From domain and the SPF-authenticated sender.
adkim r, s No DKIM identifier alignment. Same options as aspf.
ri seconds No Reporting interval. Defaults to 86400 (one day). Most receivers honor a daily cadence regardless.
fo 0, 1, d, s No Failure reporting options. 0 reports when all authentication fails. 1 reports when any check fails. d reports DKIM-only failures. s reports SPF-only failures. Combine values with a colon, for example fo=1:d.
rf afrf No Failure report format. Almost always afrf (RFC 5965). Rarely set explicitly.
FAQ

Frequently asked questions

What is a DMARC record generator?

A DMARC record generator builds the TXT entry you publish in DNS to enable DMARC for your domain. You configure your policy and reporting options through a form, and the generator outputs a syntactically valid record you can paste straight into your DNS provider. The generator handles tag ordering, escaping, and formatting, so you get a record receivers will parse correctly without having to memorize the spec.

How to implement a DMARC record for your domain?

Three things have to happen. First, your domain needs working SPF and DKIM, because DMARC builds on top of them. Without at least one of those passing and aligning, DMARC will fail every message. Second, generate your record with this tool and add it as a TXT entry at _dmarc.yourdomain.com with your DNS provider. Third, start with p=none and read the aggregate reports for two to four weeks before tightening your policy to quarantine or reject.

What's the DMARC record format?

A DMARC record is a single TXT string of semicolon-separated tag-value pairs. The version always comes first (v=DMARC1), followed by the policy (p=...), and then any number of optional tags in any order. A working example: v=DMARC1; p=quarantine; rua=mailto:reports@example.com; pct=100; aspf=r; adkim=r. The record is published at the hostname _dmarc.yourdomain.com, never at the apex domain itself.

What is DMARC domain alignment?

Alignment is how DMARC connects an SPF or DKIM pass to the domain shown in the visible "From" header. SPF authenticates the envelope sender (the bounce address), which often differs from the From address. DKIM signs with a domain that may not match either. DMARC requires the SPF or DKIM domain to align with the From domain. Relaxed alignment (r) accepts a shared organizational domain, while strict (s) requires an exact match. Without alignment, even a valid SPF or DKIM result counts as a DMARC failure.

How does DMARC work with subdomains?

By default, subdomains inherit the policy you set on your apex domain through the p tag. If you want different rules for subdomains, set the sp tag in your record. For example, p=none; sp=reject keeps your apex in monitoring mode while rejecting any failing mail from subdomains. A subdomain can also publish its own DMARC record at _dmarc.subdomain.yourdomain.com, which overrides anything set on the parent. Receivers always check the subdomain's own record first.

Can I add a DMARC record without SPF or DKIM?

Technically yes, the record will be syntactically valid. Practically no, because DMARC has nothing to evaluate. Your record only enforces a policy when SPF or DKIM produces a result for an incoming message. With neither published, every message fails DMARC, so any policy stricter than p=none will quarantine or reject all of your mail. Set up SPF and DKIM first, then layer DMARC on top.