Free tool
DMARC record generator
Choose a policy, reports and alignment, and copy the DMARC record for your domain with every tag explained.
The path
- Step 1
- none and read reports
- Step 2
- quarantine then reject
Start by watching, then tighten once your real senders pass.
Policy
Reports
Alignment
How it works
Every tag, in plain words
DMARC ties SPF and DKIM to the address people see in From, and tells receivers what to do when they fail.
- 01
Pick a policy
p tells receivers what to do with mail that fails both SPF and DKIM alignment: none (deliver and report), quarantine (spam folder) or reject.
- 02
Ask for reports
rua is where daily summary reports go. They show every server sending as your domain, so you can fix your own senders before you tighten the policy.
- 03
Set alignment
Relaxed alignment accepts a subdomain of your From domain; strict needs an exact match. Relaxed suits most setups.
- 04
Publish on _dmarc
Add the record as a TXT record named _dmarc at your DNS host. One DMARC record per domain.
FAQ
Questions, answered
Short answers about the dmarc record generator.
Which DMARC policy should I start with?
Start with p=none and a rua address. Read the reports for a few weeks, fix any service of yours that fails, then move to p=quarantine and finally p=reject.
Do I need DMARC to send cold email?
Yes. Gmail and Yahoo ask bulk senders to publish a DMARC record, and many receivers trust mail from a domain without one less. Even p=none meets the basic requirement.
What does pct do?
pct applies your policy to a share of failing mail, so you can move to quarantine or reject step by step. It has no effect with p=none and is left out of the record at 100.
Where should DMARC reports go?
To a mailbox you read or a DMARC report service, which turns the XML into charts. If the address is on another domain, that domain has to publish a record allowing it; report services set this up.