DMARC Record Generator

Free DMARC record generator. Build a valid DMARC policy (p, sp, pct, rua, ruf, alignment) and copy the TXT record to publish at _dmarc.your-domain.

What this generator does

This tool builds a valid DMARC record from your choices and gives you the exact TXT record to publish at _dmarc.<your-domain>. DMARC sits on top of SPF and DKIM and tells receiving mail servers what to do when a message fails authentication.

How to roll out DMARC safely

• Start with policy p=none and a rua reporting address — this monitors without affecting delivery.
• Run it for 2–4 weeks and read the aggregate reports to find all your legitimate senders.
• Fix any SPF/DKIM gaps, then move to p=quarantine, then p=reject.
• Use pct to apply the policy to a fraction of mail during the transition.

FAQ

Where do I publish the DMARC record?

As a TXT record at the special subdomain _dmarc.<your-domain> — not at the apex. For example.com the record name is _dmarc.example.com.

What policy should I start with?

p=none with an rua address. It's monitor-only: you collect reports about who's sending mail as your domain without risking legitimate delivery. Graduate to quarantine then reject once you've audited your senders.

What's the difference between rua and ruf?

rua receives aggregate (daily, summarized XML) reports — almost everyone wants this. ruf receives forensic (per-failure) reports, which are more sensitive and less widely supported.

What does alignment (adkim/aspf) mean?

Alignment controls how strictly the authenticated domain must match the visible From: domain. Relaxed (the default) allows subdomains; strict requires an exact match. Start relaxed.

How do I check it worked?

After publishing, use the DMARC check to confirm it resolves. See the DMARC glossary entry for tag-by-tag detail.

Background reading

See the DNS Records Explained guide, plus SPF and DKIM.