DMARC record generator
This DMARC record generator creates the v=DMARC1 TXT record you publish at _dmarc.yourdomain. Pick a policy, add an address for reports, and copy the result. It flags the settings that stop reports arriving or block your own mail.
Where does the DMARC record go?
Publish it as a TXT record on the _dmarc name under your domain, so the full name is _dmarc.example.com. In most DNS panels you type _dmarc as the host. A domain has one DMARC record. Subdomains without their own record follow the parent's policy, or its sp= value if one is set. (RFC 9989)
Which DMARC policy should I start with?
Start with p=none and a report address. It blocks nothing, so no legitimate mail is lost, and the reports show every service sending as your domain. Google recommends about a week on p=none while you review reports, then quarantine for a small share of mail, then reject. The DMARC policy guide covers each step. (Google)
What should the rua address be?
A mailbox or reporting service that can handle a steady stream of XML attachments. If the address is on a different domain from the one you are protecting, that domain must publish an authorization record at yourdomain._report._dmarc.theirdomain, or receivers will not send it your reports. The checker tests this for you. (RFC 9990, section 4)
What does test mode do?
RFC 9989 replaced the old pct tag with t=y, which asks receivers to apply one level less strict than your stated policy. Google's rollout guide still describes pct, and receivers adopt new standards gradually. Receivers ignore tags they do not recognize, so the generator adds both when you tick test mode. Remove both at full enforcement. (RFC 9989, Google)
What is DMARC alignment?
DMARC passes only when SPF or DKIM passes for a domain that matches the From: address readers see. Relaxed alignment, the default, accepts a subdomain of the same organizational domain. Strict alignment needs an exact match. Most senders should keep relaxed, because many sending tools sign or bounce from a subdomain. (RFC 9989)
What must be in place before DMARC?
SPF and DKIM for every service that sends mail as your domain. Google recommends setting both up at least 48 hours before adding DMARC. Build SPF with the SPF record generator, and if you do not know which DKIM selector a service uses, see how to find your DKIM selector. (Google)
Frequently asked questions
Do Gmail and Yahoo require a DMARC record?
Bulk senders, meaning more than 5,000 messages a day to their users, must publish DMARC with at least p=none, and Microsoft applies the same rule to Outlook.com. Every domain that sends mail benefits from one. (Google)
Can I have more than one DMARC record?
No. If receivers find more than one DMARC record at _dmarc, they treat the domain as having none. Edit the existing record instead of adding a second.
Should I add a ruf address for failure reports?
It is optional, and many receivers do not send failure reports. Aggregate reports through rua are what you need to find unauthenticated senders.
Does this generator store my domain or address?
No. The record is built in your browser and nothing is sent anywhere.