DMARC
GENERATOR
Set the policy you want and this builds the DMARC TXT record for you: the enforcement level, the addresses that receive aggregate and forensic reports, how strictly SPF and DKIM must align, and what share of mail the policy applies to. The record is assembled in your browser and validated as you go.
v=DMARC1; p=noneBuilt in your browser, never sent anywhere. Once the record is live, confirm it resolves and check the policy is being read correctly.
Check a published DMARC recordWhat is a DMARC Record Generator?
A DMARC record generator is a free tool that builds the DMARC TXT record for a domain from the settings you choose: the enforcement policy, the addresses that receive reports, how strictly SPF and DKIM must align, and what share of mail the policy covers. It assembles the tags in the order the spec requires, ready to publish at _dmarc on your domain.
How does a DMARC Record Generator work?
- 01Choose an enforcement policy: none to monitor, quarantine to send failures to spam, or reject to block them.
- 02Add the addresses that should receive reports, and set alignment and rollout percentage if you need them.
- 03We assemble the tags in the order the spec requires and give you a record to paste at _dmarc.yourdomain.com.
Frequently asked questions
Which DMARC policy should I start with?
Start with p=none. It changes nothing about how your mail is handled but tells receiving servers to send you aggregate reports, which show every source sending as your domain. Once those reports confirm your legitimate mail passes SPF or DKIM, move to quarantine, then to reject. Publishing reject first is the common way to lose real email.
Where does the DMARC record go in DNS?
It is a TXT record on the _dmarc subdomain of the domain you are protecting, so for example.com the host is _dmarc.example.com. Some DNS panels want the full name and some want just the _dmarc part, so check which convention yours uses. Only one DMARC record is allowed per domain; a second one invalidates both.
Do I need SPF and DKIM before DMARC?
Yes. DMARC does not authenticate anything itself, it decides what happens when SPF and DKIM results are checked against the visible From domain. With neither in place, a policy of reject will block your own mail. Publish SPF and DKIM first, confirm they pass, then add DMARC on top.