Skip to main content
WebTools

DMARC record generator

Build a DMARC record for your domain: choose what receivers should do with mail that fails, and where to send reports. We check it before you publish.

What receivers should do with mail that claims to be from this domain but fails SPF and DKIM alignment.

Up to 3 email addresses, one per line, for daily summary reports. Recommended: without one you can't see who sends as your domain.

For subdomains such as mail.example.com that have no DMARC record of their own.

For made-up names such as anything.example.com, which only spammers use. Reject is safe for most domains.

Up to 2 addresses for reports about single failing messages. Few receivers send them, and they can include parts of messages.

Only used with a failure report address.

Testing mode lets you publish quarantine or reject while receivers still treat mail as p=none, one step down.

Choosing a check opens its page. With the keyboard, use the arrow keys, then press Enter.

How to use this generator

Enter your domain, choose a policy and add an address for reports. We build the DMARC record, check it, and show the exact name to publish it under: _dmarc followed by your domain. The record follows RFC 9989, the current DMARC standard.

A safe way to reach reject

  1. Publish p=none with a report address. Mail is delivered as normal, and you receive daily reports.
  2. Use the reports to find every service that sends as your domain, and set up SPF and DKIM for each. Our SPF Record Generator and DKIM Checker help.
  3. Move to p=quarantine, then p=reject. Testing mode (t=y) lets you publish the stricter policy while receivers still apply one step less.

DMARC needs SPF or DKIM

A message passes DMARC when SPF or DKIM passes for a domain that matches the From address. Without either, a strict policy would stop your own email, so check them first.

Frequently asked questions

Which policy should I start with?

Start with p=none and a report address. Reports show every service sending as your domain, so you can fix SPF and DKIM for each. Then move to quarantine and, once nothing legitimate fails, reject.

Where do I publish the record?

As a TXT record named _dmarc at your domain, for example _dmarc.example.com. Many DNS panels want just _dmarc in the name box. A domain has one DMARC record: replace any existing one.

Why don't I see pct, rf or ri?

They were removed in RFC 9989, the current DMARC standard. Receivers following it ignore them. To test a stricter policy first, use testing mode (t=y) instead of pct.

Can reports go to another company's address?

Yes, for example a DMARC reporting service. That company must publish a small record saying it accepts reports for your domain. We check for it and show the record it needs.

Is what I enter saved?

No. The record is built and checked when you press Generate, then shown to you. It isn't cached, saved, logged or shown in recent checks.

Guides about this tool

More email guides

Related tools

  • DMARC Checker

    Find the DMARC policy that applies to a domain, see what each setting means, and spot mistakes that make receivers ignore it.

  • SPF Record Generator

    Build one SPF record for your domain from the services that send your email. We check it the way receivers do, including the limit of 10 DNS lookups.

  • SPF Checker

    Check that a domain's SPF record is valid, stays within the 10-lookup limit, and says what you expect about servers that may send its mail.

  • DKIM Checker

    Check the DKIM key a domain publishes for signing its email: whether it is there, its type and size, and common mistakes.