Skip to content

Free tool

DMARC Record Generator

A DMARC record is a TXT record at _dmarc.yourdomain.com that tells receiving servers what to do with mail failing SPF and DKIM alignment, and where to send reports. Choose a policy and a report address below, and copy a valid record straight into your DNS.

Policy (p)

What receivers should do with mail that fails DMARC: deliver it (none), send it to spam (quarantine) or refuse it (reject).

Legacy percentage (pct) optional+

Removed in RFC 9989 in favour of t=y. Older receivers may still read it. Leave empty unless you need it.

Daily XML summaries of who sent mail as your domain. Separate several addresses with commas. We add mailto: for you.

Per-message reports about individual failures.

DKIM alignment (adkim)
SPF alignment (aspf)

Relaxed lets mail.example.com align with example.com. Strict needs an exact match. Relaxed is the default and suits most domains.

Failure reporting options (fo)

Your DMARC record

TXT
Host / name
_dmarc.example.com
Value
v=DMARC1; p=none

Some DNS providers add your domain automatically. If yours does, enter only _dmarc as the host.

  • Add at least one rua address. Without aggregate reports you cannot see who sends as your domain, so you cannot safely move past p=none.
  • p=none is monitoring only: mail that fails DMARC is still delivered. Start here, read the reports, then tighten the policy.

How it works

From settings to a published record

  1. Choose your settings

    Pick a policy, add a report address and leave the rest on the defaults unless you have a reason to change them.

  2. Copy the TXT record

    Copy the host and the value. Everything runs in your browser, so nothing you type is sent to us.

  3. Publish it in DNS

    Add one TXT record at _dmarc.yourdomain.com with your DNS provider. Replace any existing DMARC record rather than adding a second.

Using the result

Roll out from p=none to p=reject

Jumping straight to reject is the most common way to block your own mail. Move in stages and let the reports tell you when it is safe.

  1. Stage 1

    Monitor with p=none

    Nothing is blocked. Read the aggregate reports for a few weeks and list every service that sends as your domain: your mailbox provider, CRM, newsletter tool, billing system, help desk.

    v=DMARC1; p=none; rua=mailto:dmarc@example.com
  2. Stage 2

    Fix senders, then quarantine

    Once every legitimate sender passes SPF or DKIM with alignment, move to quarantine. Adding t=y (test mode) first asks receivers to hold back one level while you confirm the reports stay clean, then remove it.

    v=DMARC1; p=quarantine; t=y; rua=mailto:dmarc@example.com
  3. Stage 3

    Enforce with p=reject

    Receivers now refuse mail that fails DMARC, which stops direct spoofing of your domain. Keep reading reports: a new tool added later without SPF or DKIM setup will start failing.

    v=DMARC1; p=reject; rua=mailto:dmarc@example.com

Reference

DMARC tags and their defaults

Tags left out of a record take their default value, so the generator only writes tags you change.

DMARC record tags, what they do and their default values, from RFC 9989
Tag What it does Default
v Version. Must be DMARC1 and must come first. Required
p Policy for the domain: none, quarantine or reject. Required
sp Policy for existing subdomains. Same as p
np Policy for subdomains that do not exist in DNS. New in RFC 9989. Same as sp, or p
t Test mode. y asks receivers to apply one level below p. New in RFC 9989. n
rua Where to send daily aggregate reports. None
ruf Where to send per-message failure reports. None
adkim DKIM alignment: r (relaxed) or s (strict). r
aspf SPF alignment: r (relaxed) or s (strict). r
fo When to generate failure reports: 0, 1, d, s. 0
pct Share of failing mail to apply the policy to. Removed in RFC 9989. Legacy

DMARC was first published as RFC 7489 in 2015, an informational document. In May 2026 the IETF replaced it with RFC 9989, a Proposed Standard, with reporting moved to RFC 9990 and RFC 9991. Records still start with v=DMARC1, so existing records keep working. The main changes for record authors: pct, rf and ri are removed, t and np are added, and size limits on report addresses (such as !10m) are obsolete. This generator follows RFC 9989.

FAQ

DMARC record FAQ

Where do I put a DMARC record?

Publish it as a TXT record on the host _dmarc under your domain, for example _dmarc.example.com. Many DNS providers add the domain for you, so you enter only _dmarc in the host field. A domain should have exactly one DMARC record.

Should I start with p=none or p=reject?

Start with p=none and a rua address. Going straight to reject can block legitimate mail from tools you forgot about, such as an invoicing system or help desk. Move to quarantine and then reject once reports show every real sender passing.

Do I need SPF and DKIM before DMARC?

Yes, in practice. DMARC passes when SPF or DKIM passes and aligns with the domain in the From address. Without at least one of them set up for each sender, every message fails DMARC, which is harmless at p=none but blocks mail at reject.

What happened to the pct tag?

RFC 9989, the May 2026 DMARC standard, removed pct because receivers applied values other than 0 and 100 inconsistently. Its replacement is t=y (test mode), which asks receivers to apply one level below your policy. Old records with pct still work, since unknown tags are ignored.

What is the difference between rua and ruf?

rua receives aggregate reports: daily XML summaries that count messages by sending IP and authentication result. ruf receives failure reports about individual messages. Aggregate reports are the ones you need. Many large providers do not send failure reports at all.

Will DMARC improve my deliverability?

It helps. Gmail, Yahoo and Outlook.com require bulk senders to publish a DMARC record (p=none is enough), and enforcement stops others spoofing your domain. It does not fix a dirty list: hard bounces from invalid addresses still hurt your reputation, which is what email verification prevents.

Keep going

Sources

Authentication set? Now clean the list

DMARC proves your mail is really from you. Verifying your list keeps hard bounces from undoing that reputation.

Start free Bulk verification

100 free credits · No card required · Credits never expire