DMARC Record Generator
Create a valid DMARC record for your domain. Choose your policy, reporting, and alignment settings.
Configure Your DMARC Record
Host name (TXT record)
_dmarc.yourdomain.comSome DNS providers add your domain automatically. If yours does, enter only _dmarc.
Value
v=DMARC1; p=nonep=none is monitoring only. It collects reports but does not stop spoofed mail. Move to quarantine and then reject once all your senders pass.
Add a rua address. Without it you get no reports and cannot see who sends mail as your domain.
Where to Publish Your DMARC Record
Your DMARC record must be published as a TXT record in your DNS. The record hostname is _dmarc followed by your domain name.
For example, if your domain is example.com, create a TXT record at _dmarc.example.com. If you manage subdomains separately, you create a separate TXT record at _dmarc.subdomain.example.com for each subdomain.
After publishing the record, use a DMARC lookup tool to verify it is resolving correctly. Check your aggregate reports over the next few days to confirm receiving servers are honoring your policy.
DMARC Tag Explanations
| Tag | Description |
|---|---|
| v | DMARC version. Always set to DMARC1. |
| p | Policy for the organizational domain. Accepts none, quarantine, or reject. |
| rua | Where aggregate reports get sent, as mailto: addresses separated by commas. |
| ruf | Where failure (forensic) reports get sent, as mailto: addresses. Many receivers do not send these. |
| sp | Subdomain policy. Inherits the p tag value if omitted. |
| adkim | DKIM alignment mode. Relaxed (r) or strict (s). Default is r. |
| aspf | SPF alignment mode. Relaxed (r) or strict (s). Default is r. |
| pct | Percentage of failing messages the policy applies to. Default is 100. |
| fo | When to send failure reports. 0 (default): both SPF and DKIM fail to align. 1: either fails. d: DKIM fails. s: SPF fails. Only used with ruf. |
Frequently Asked Questions
A DMARC record is a TXT record published in your DNS at _dmarc.yourdomain.com. It tells receiving mail servers how to handle messages from your domain after SPF and DKIM checks, and where to send authentication reports.
Publish your DMARC record as a TXT record in your DNS at the subdomain _dmarc.yourdomain.com. For example, if your domain is example.com, the record goes at _dmarc.example.com.
Start with p=none to monitor your email traffic without affecting delivery. Collect aggregate reports to identify all services sending on your behalf. Move to p=quarantine or p=reject once you confirm all legitimate senders pass authentication.
Relaxed alignment allows the domain in the From header to match the SPF or DKIM domain at the organizational level. Strict alignment requires an exact match. For example, relaxed alignment allows mail.example.com to align with example.com, while strict does not.
The pct tag controls what percentage of failing messages your policy applies to. With p=quarantine and pct=10, 10% of failing messages are quarantined and the rest are treated as p=none. With p=reject, the rest are quarantined instead. This tag helps you move to enforcement gradually.
Generate and deploy your DMARC record
DMARC+ monitors your DMARC reports, identifies unauthorized senders, and guides you to full enforcement.
Start Your 14-Day Trial