DMARC Record Generator
This free DMARC record generator builds a valid DMARC TXT record from a few choices and tells you exactly which host and value to add to your DNS.
New to DMARC? Start with p=none and a rua address, then tighten step by step, as described in our DMARC checker's rollout advice. The record is built in your browser and nothing is sent to us.
What does a DMARC record do?
A DMARC record tells receiving mail servers what to do with email that claims to be from your domain but fails SPF and DKIM checks: deliver it, send it to spam, or reject it.
It also asks them to send you reports, so you can see every service sending mail as your domain, the ones you know about and the ones you don't.
How to add the record to your DNS
Add a TXT record with the host _dmarc (some DNS panels want the full _dmarc.yourdomain.com) and paste the value exactly as shown. You only ever need one DMARC record per domain.
Give DNS a few minutes, then use the Check it button to read the live record with our DMARC checker. The generator itself runs in your browser, so nothing you type is sent to us.
Roll out DMARC in three steps
Start with p=none and a rua address. Nothing gets blocked; you just collect reports. Read them for a couple of weeks and fix any legitimate service that fails SPF or DKIM.
Then move to p=quarantine, optionally with a lower pct to apply it to only part of your mail at first, and finally to p=reject. That order protects your domain without losing real mail on the way.
What the tags mean
v=DMARC1 must come first, followed by p, the policy. sp sets a different policy for subdomains, and pct applies the policy to only a share of failing mail. We leave out any tag that just repeats its default, which keeps the record short.
rua receives daily aggregate reports and ruf receives individual failure reports. adkim and aspf choose relaxed alignment (subdomains count as a match) or strict alignment (exact domain only), and fo controls when failure reports are sent.
Frequently asked questions
Which DMARC policy should I start with?
p=none with a rua address. It changes nothing for delivery and shows you who sends mail as your domain. Tighten to quarantine and then reject once every legitimate sender passes.
Where do DMARC reports go?
To the address in rua. The reports are XML files, so many people use a free or paid DMARC report service, which gives you an address to put here and turns the XML into readable charts.
Can I send reports to an address at another domain?
Yes, but that domain must agree to receive them by publishing a small TXT record (RFC 7489, section 7.1). Report services set this up for you.
Do I need SPF and DKIM before DMARC?
You need at least one of them working and aligned with your From domain for DMARC to pass, and ideally both. Our SPF record generator and DKIM checker help with those.
Should I use strict alignment?
Usually not. Relaxed alignment lets mail sent from a subdomain, like news.example.com, pass for example.com. Strict is only worth it if you control every sending subdomain and want to lock it down.