DMARC Record Generator
Configure your DMARC policy, reporting addresses, and alignment settings. Your record is built in real time below.
Receive daily XML reports showing which emails passed and failed authentication. Strongly recommended.
Receive per-message failure reports. Note: many providers have discontinued ruf reporting for privacy reasons.
v=DMARC1; p=noneDNS Instructions
- • Record type: TXT
- • Host / Name:
_dmarc(or_dmarc.yourdomain.com) - • TTL: 3600 (1 hour)
- • Start with
p=noneto collect reports before enforcing quarantine or reject.
What the generator produces
The generator assembles a single TXT value from your choices and updates it as you type. It always writes v=DMARC1 followed by p=. It adds sp= only when you pick a subdomain policy other than inherit, rua= and ruf= when you enter an address (a leading mailto: is stripped and re-added for you), adkim= and aspf= only when you choose strict, and pct= only when the slider is below 100. Defaults are omitted on purpose because they are implied by the protocol.
It does not write the fo or ri tags and accepts one address per report type. If you need several recipients, edit the output by hand and separate the URIs with commas.
Example output with every option used
v=DMARC1; p=quarantine; sp=reject; rua=mailto:dmarc-reports@yourdomain.com; ruf=mailto:dmarc-forensic@yourdomain.com; adkim=s; aspf=s; pct=25
Publishing the record in DNS
- Create a TXT record. The host or name is _dmarc (your DNS panel appends the domain) or _dmarc.yourdomain.com if the panel wants the full name.
- Paste the generated string as the value. Some panels want it wrapped in quotes and some add the quotes themselves. If the checker later shows doubled quotes, remove yours.
- Keep exactly one DMARC record on that name. Edit the existing one rather than adding another.
- Use a TTL of 3600 while you are changing policies, so mistakes are quick to undo.
- Run the DMARC checker after a few minutes to confirm what the public resolvers see.
Choosing each setting
| Setting | Recommendation | Why |
|---|---|---|
| Policy | Start with none | Nothing is blocked while you learn which systems send as your domain. |
| Subdomain policy | Leave on inherit until you are enforcing | Then use reject if your subdomains do not send mail. Spoofers often target unused subdomains. |
| rua address | Always set one | Without reports you cannot tell which senders would break. Use a dedicated mailbox, or a DMARC reporting service so the XML is parsed for you. |
| ruf address | Optional, usually skip | Failure reports can contain message content and many large receivers do not send them. |
| adkim / aspf | Keep relaxed | Strict alignment breaks mail from legitimate subdomain senders and gives little extra protection for most organizations. |
| pct | 100 for none, stepped up for enforcement | Percentage only changes how much failing mail the policy applies to. The remainder gets the next weaker treatment (quarantine for reject, none for quarantine). |
Ready-to-use records for each stage
Stage 1: monitor
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com
Stage 2 is quarantine with a small percentage, for example v=DMARC1; p=quarantine; pct=10; rua=mailto:dmarc@yourdomain.com. Raise pct to 25, 50 and 100 as reports stay clean. Stage 3 is v=DMARC1; p=reject; rua=mailto:dmarc@yourdomain.com. The generator can build all three; the pacing is up to you. Two to four weeks at stage 1 is typical, longer if you have many third-party senders.
Before you tighten the policy
- Inventory every sender: your mailbox provider, marketing and newsletter platforms, CRM, invoicing, helpdesk, website forms and any application servers.
- Confirm each one passes SPF or DKIM in alignment with your From domain. Passing on the sender's own domain is not enough for DMARC.
- Make sure DKIM is signing with your domain for each service. This survives forwarding, which SPF does not.
- Do not point rua at a mailbox that is not monitored. Large domains can receive many reports per day.
- If the rua address is on a different domain than the one you are protecting, the receiving domain needs an authorization TXT record at yourdomain.com._report._dmarc.reportdomain.com with the value v=DMARC1.
Common mistakes the generator cannot catch
| Mistake | Result | Fix |
|---|---|---|
| Publishing p=reject on day one | Legitimate mail from forgotten systems is rejected | Run p=none first and read the reports. |
| Adding a second TXT record at _dmarc | Receivers ignore DMARC when more than one record exists | Merge into a single record. |
| Record placed at the apex instead of _dmarc | No DMARC is detected | Change the host to _dmarc. |
| Forgetting that subdomains inherit p | A strong policy on the main domain also applies to subdomains, which can surprise teams using subdomains for marketing | Set sp explicitly if subdomains need a different policy. |
| Enforcing without working SPF or DKIM | Everything fails alignment | Build SPF and DKIM first. |
Limitations
The generator builds a syntactically valid record from your inputs. It cannot see your DNS, so it does not know if a record already exists, and it cannot tell you whether your senders are ready for enforcement. It does not check that the report mailbox exists or that external report authorization is in place. Always verify the published result with the checker, and use real aggregate data to decide when to move to the next stage.
Related tools and guides
Frequently Asked Questions
What DMARC policy should I start with?
Always start with p=none. This monitoring-only mode lets you receive aggregate reports showing which emails pass or fail authentication, without affecting mail delivery. Once you have reviewed the reports and confirmed all legitimate senders are passing, move to p=quarantine (spam folder), then finally to p=reject (block completely).
What is the rua tag in a DMARC record?
The rua tag specifies where aggregate DMARC reports are sent. These are XML files delivered daily by receiving mail servers, showing a summary of all emails sent from your domain and whether they passed SPF and DKIM. Setting rua is strongly recommended — without it, you have no visibility into your authentication results.
What is DMARC alignment and should I use relaxed or strict?
DMARC alignment determines how strictly the authenticated domain must match the From domain. Relaxed alignment (adkim=r; aspf=r) allows matching subdomains and is the default. Strict alignment (adkim=s; aspf=s) requires an exact match. Most organisations should use relaxed alignment — strict alignment can cause legitimate mail to fail if you use subdomains for sending.
What does the pct tag do in a DMARC record?
The pct (percentage) tag applies the DMARC policy to only that percentage of failing mail. For example, pct=20 with p=quarantine would send 20% of failing emails to spam and deliver the rest. It is useful for gradually rolling out quarantine or reject without risking legitimate mail being blocked. Default is pct=100.
Where does a DMARC record go in DNS?
A DMARC record must be published as a TXT record at _dmarc.yourdomain.com — the subdomain _dmarc directly under your domain. For example, if your domain is example.com, the record goes at _dmarc.example.com. The record starts with v=DMARC1 and must follow the correct semicolon-separated tag format.