DMARC record generator
Build a valid DMARC record in a minute: choose a policy, add where reports should go, and copy the exact DNS entry. Load your current record to tighten it.
DMARC RECORD GENERATOR
1. Policy: what happens to email that fails?
2. Reports
Advanced options
YOUR DMARC RECORD
v=DMARC1; p=none
| Type | Host / Name | Value | TTL |
|---|---|---|---|
| TXT | _dmarc | v=DMARC1; p=none | 3600 |
Some DNS panels want the full name, _dmarc.yourdomain.com. Keep only one DMARC record. After publishing, check it here.
Roll out DMARC without losing real email
- Week 0: make sure SPF is valid and DKIM is on for every service that sends as you (check both).
- Weeks 1-4: publish
p=nonewith aruaaddress. Reports show every server sending as your domain. Fix any real sender that fails. - Next 2 weeks:
p=quarantine, optionally withpct=25and then 100. - Then:
p=reject. Spoofed mail is now blocked, and you can add BIMI to show your logo in Gmail.
About the reports
Aggregate reports (rua) are XML files sent daily by Gmail, Yahoo, Outlook.com and others. They're hard to read raw, so use a mailbox you don't mind filling up, or a free DMARC report reader. Reports sent to a mailbox on another domain only arrive if that domain publishes a permission record; report services set this up for you.
Relaxed vs strict alignment
DMARC passes when SPF or DKIM passes and matches the domain in the From address. Relaxed alignment accepts subdomains (mail.yourdomain.com matches yourdomain.com); strict needs an exact match. Relaxed is right for almost everyone.
FAQ
What is a DMARC record?
A TXT record at _dmarc.yourdomain.com that tells receiving servers what to do with email that fails SPF and DKIM checks (deliver, send to spam or reject) and where to send reports.
What is the best DMARC policy?
p=reject gives full protection, but start with p=none for a few weeks so reports can show any legitimate sender that would fail. Then move to quarantine and reject.
Where do I add the DMARC record?
At your DNS provider: add a TXT record with host "_dmarc" (or "_dmarc.yourdomain.com" if the panel wants the full name) and the generated record as the value.
Do I need DMARC for a small website?
If your domain sends any email, yes: Gmail and Yahoo expect it, and it stops scammers using your domain. If it sends none, publish "v=DMARC1; p=reject" to lock it.
Can I have more than one DMARC record?
No. With two records at _dmarc, receivers ignore DMARC entirely. Edit the existing record instead.
CHANGING HOSTS?
DNS is where most migrations go wrong. Follow the hosting switch checklist, lower your TTL a day before, and use the propagation checker after the switch. Comparing new hosts? See real renewal prices.