EN
Sign inRequest access
Menu

DMARC record generator

Create a DMARC record from three choices: the policy for mail that fails, where reports go and how strict the checks are. Every tag in the record is explained. It runs in your browser and saves nothing.

Used only to show the record name and a reports address.

What should receivers do with mail that fails SPF and DKIM?

One or more addresses, separated by commas. Reports arrive as files, usually once a day.

100 is the default. A lower number applies the policy to part of the failing mail while you move to a stricter policy. It has no effect with p=none.

Your DMARC record

Type
TXT
Name
_dmarc (in front of your domain)
Value
v=DMARC1; p=none
v=DMARC1
Marks the TXT record as DMARC. It must come first.
p=none
Mail that fails SPF and DKIM is delivered, and reports are sent.

Add a reports address: without one, you cannot see who sends mail as your domain.

Publish it as a TXT record at _dmarc (in front of your domain), in place of any DMARC record already there.

Create your record in three steps.

  1. Choose the policy

    Start with p=none while you find out which services send as your domain.

  2. Add a reports address

    Use a mailbox that you read, or a DMARC report service. Reports arrive as files, usually once a day.

  3. Publish and check

    Publish the record as a TXT record at _dmarc in front of your domain, then check it with the DMARC checker.

Start with p=none and a reports address.

p=none changes nothing for your mail, but the reports show every server that sends as your domain. When only your own services appear, move to p=quarantine, and later to p=reject.

Most domains need only three tags.

v=DMARC1, p= and rua= cover most domains. Leave sp=, pct=, adkim= and aspf= at their defaults unless you have a reason to change them: the generator leaves a tag out when it would only repeat the default.

Common questions about creating a DMARC record

Is the DMARC record generator free?

Yes. It runs in your browser, needs no sign-up and saves nothing.

Which policy should I start with?

p=none with a reports address, unless you are sure that every service that sends as your domain passes SPF or DKIM. Then you can start at p=quarantine.

What is the pct tag for?

It applies the policy to only part of the failing mail, so you can move to quarantine or reject step by step. It has no effect with p=none, so the generator leaves it out then.

Should alignment be relaxed or strict?

Relaxed, the default, accepts subdomains of your domain, for example a service that sends from mail.yourcompany.com. Strict needs an exact match; use it only if you know that you need it.

Where do I publish the record?

As a TXT record with the name _dmarc in front of your domain. Many DNS panels want only _dmarc in the name field.