DMARC Record Generator
Choose a policy and where reports should go to get the TXT record to add to your domain, with a careful order for tightening it over time.
Worked examples
A monitoring record
Domain example.com, policy none, reports to [email protected]
_dmarc.example.com TXT: v=DMARC1; p=none; rua=mailto:[email protected]
Move to quarantine and then reject when the reports show only mail you recognise failing.
About DMARC Record Generator
Anyone can send an email that claims to come from your domain. DMARC is how you tell receiving mail systems what to do with messages that say they are from you but fail your own checks. With it, forged mail can be sent to spam or refused, and you receive reports showing who is sending mail in your name, including forgotten services that need to be set up properly. Major mailbox providers now expect domains that send a lot of mail to publish a record.
The record is a single line of text added to your DNS at _dmarc on your domain. This generator builds it from your choices: the policy for failing mail, the policy for sub-domains, where summary and failure reports go, how strictly the sender must line up with your domain, and what share of mail the policy applies to. It checks report addresses and the percentage, and shows the host name to use. A step by step plan explains how to move from just monitoring to rejecting, which is the careful way to avoid blocking your own mail.
How to use DMARC Record Generator
- Enter your domain, choose a policy and enter an address for summary reports.
- Leave the alignment settings on relaxed unless you know you need strict.
- Copy the record value and add it as a TXT record at the host name shown.
- Read the reports for a few weeks, then tighten the policy step by step.
Common uses
- Publishing a first DMARC record in monitoring mode
- Moving from quarantine to reject once reports look clean
- Setting a different policy for sub-domains
- Preparing for mailbox provider rules on bulk senders
Frequently asked questions
Which policy should I start with?
Start with none, which only reports. It does not stop forged mail but shows you who is sending as your domain. When every legitimate sender passes, move to quarantine, and later to reject.
What does DMARC need to work?
At least one of SPF or DKIM must pass and line up with the domain in the From address. Set up SPF and DKIM for everything that sends your mail first, including newsletters and invoicing systems.
What does the percentage do?
It applies the policy to only that share of failing mail, so you can bring in quarantine or reject slowly. Leave it at 100, or leave it out, once you are confident.
What are failure reports?
Detailed reports about single messages that failed. Many providers do not send them because they can contain personal information. Summary reports are the useful ones for most people.
Can I have more than one DMARC record?
No. A domain must have exactly one at _dmarc. If you find two, remove one, or receivers may ignore both.