DMARC Record Generator
Choose your options and copy a valid DMARC record to publish in your DNS.
Where daily aggregate reports are sent. Needed to see who sends as you.
RFC 9989 tag. Set reject for domains that send no mail, to stop subdomain spoofing.
Advanced options
Stage enforcement without acting on mail. Replaces the removed pct tag (RFC 9989).
Your DMARC record
v=DMARC1; p=noneHow to publish it
Add a DNS TXT record with:
Host / name: _dmarc
Value: the record above.
Build, publish, verify, enforce
- 1
Generate a monitoring record
Leave the policy on p=none, add an rua address, and copy the record. This collects reports without touching your mail.
- 2
Publish it in your DNS
Add it as a TXT record with the host set to _dmarc. It applies within minutes to a few hours.
- 3
Verify and monitor
Check the record with the DMARC checker, then read the aggregate reports to find every legitimate sender.
- 4
Enforce
Once your mail passes SPF and DKIM in alignment, regenerate with p=quarantine, then p=reject. Use test mode (t=y) to stage a stricter policy first.
Related tools
Frequently asked questions
What is a DMARC record generator?
It is a form that builds a valid DMARC DNS record from the options you choose (policy, reporting address, alignment and so on). You copy the result and publish it as a TXT record in your DNS. It saves you memorising the tag syntax and avoids typos that stop DMARC working.
Where do I publish the DMARC record?
Add it as a TXT record in your DNS with the host or name set to _dmarc (so it resolves at _dmarc.yourdomain.com) and the value set to the generated record. Most DNS providers apply it within minutes to a few hours.
Which policy should I start with?
Start with p=none. It takes no action on your mail but collects reports, so you can see every service sending as you before you enforce. Once your legitimate mail passes SPF and DKIM in alignment, move to p=quarantine and then p=reject.
What do adkim and aspf do?
They set how strictly DKIM and SPF must align with your From domain. Relaxed (r) allows subdomains to match and is the default. Strict (s) requires an exact match. Start relaxed unless you have a specific reason to be strict.
How do I read the DMARC reports?
Aggregate reports arrive as XML at your rua address, one per sending source per day, which is hard to read by hand. Blankitt DMARC parses them into a dashboard and alerts, and gives you a reporting address to use. There is a free tier.