dmarc record generator
build a valid DMARC record for your domain. pick a policy, add a reporting address, and copy the TXT record for _dmarc.yourdomain.com — with live warnings for the mistakes that either let spoofed mail through or silently drop legitimate email.
v=DMARC1; p=none
- p=none is monitoring only — it provides no protection. Move to quarantine, then reject, once your reports look clean.
- No rua address — you won't receive aggregate reports, so you can't see what fails DMARC.
Overview
DMARC (Domain-based Message Authentication, Reporting and Conformance) tells receiving mail servers what to do with mail that claims to be from your domain but fails SPF and DKIM alignment. it is published as a single TXT record at _dmarc.yourdomain.com. the core tags are: v=DMARC1 (required, first), p= (the policy: none, quarantine or reject), rua= (where to send aggregate reports), sp= (a separate policy for subdomains), pct= (roll the policy out to a percentage of mail), and adkim/aspf (strict or relaxed alignment). the safe rollout is a ramp, not a switch: start at p=none with a rua address and read the reports for a couple of weeks; move to p=quarantine; then p=reject once your legitimate senders all pass. jumping straight to p=reject without watching reports is the most common way to lose real email. this generator builds the record and flags that ramp for you.
How to use
- choose a policy — start at none to monitor, then quarantine, then reject.
- add a rua address — aggregate reports go here — without it you're flying blind.
- tune the optional tags — subdomain policy, pct rollout, and strict alignment if you need them.
- publish the TXT record — create a TXT record at _dmarc.yourdomain.com with the copied value.
Examples
input policy none · rua [email protected]
output v=DMARC1; p=none; rua=mailto:[email protected]
input
policy reject · rua + strict alignmentoutput v=DMARC1; p=reject; rua=mailto:[email protected]; adkim=s; aspf=s
Common mistakes
p=reject too early— reject drops failing mail with no bounce. always run none/quarantine and read rua reports first.no rua address— without rua you get no reports, so you can't tell which of your senders fail before you enforce.the record goes at _dmarc, not the apex— publish at _dmarc.yourdomain.com — a TXT at the apex is SPF, not DMARC.strict alignment can break subdomains and ESPs— adkim=s / aspf=s require an exact domain match. many ESPs only align at the organizational-domain (relaxed) level.
FAQ
where do i put the record?
as a TXT record on the host _dmarc.yourdomain.com (for subdomains, _dmarc.sub.yourdomain.com).
what policy should i start with?
p=none with a rua address. it changes nothing about delivery but starts the reports that tell you what to fix.
do i need SPF and DKIM too?
yes. DMARC only acts on the results of SPF and DKIM alignment — with neither set up, DMARC has nothing to enforce.
what is alignment?
DMARC passes only if the domain that passed SPF or DKIM matches the From: domain. relaxed matches the organizational domain; strict requires an exact match.
does one DMARC record cover subdomains?
the _dmarc record at your organizational domain applies to subdomains too, unless a subdomain has its own _dmarc record. use sp= to set a different policy for subdomains while keeping p= for the parent.
Related tools
dmarc checker— find and parse a domain's DMARC policy record at _dmarc.<domain>.spf record generator— build a valid SPF TXT record from your includes, IPs and qualifier — with a live count of the 10-DNS-lookup limit.spf checker— find and parse a domain's SPF (sender policy framework) record.dkim lookup— probe common DKIM selectors (default, google, k1, selector1/2, mxvault) for a domain.
References
Free beta
Unlock your full scan (free beta)
Add one DNS TXT record to prove you own the domain, then we run a deeper active scan — exposed secrets and config — and send you a private report. Free beta, no payment.
- Finds exposed .env / .git / backups and other sensitive files
- Verified by a DNS TXT record, so only you can run it on your domain
- A private report emailed straight to you