DMARC Record Generator
Create a _dmarc TXT record with policy, reports and alignment.
About this tool
Choose a policy, an optional subdomain policy and percentage, the addresses for aggregate (rua) and forensic (ruf) reports, and DKIM/SPF alignment modes. You get the TXT record to publish at _dmarc on your domain, plus warnings and a recommended rollout path.
How DMARC protects your domain
SPF and DKIM prove a message came from an authorised server or was signed by a domain, but neither guarantees that the From address people see matches. DMARC (RFC 7489) ties them together. A message passes DMARC only if SPF or DKIM passes and aligns with the visible From domain. Your DMARC record tells receivers what to do with mail that fails: p=none (just report), p=quarantine (send to spam) or p=reject (refuse it). It also tells them where to send reports. Aggregate reports (rua) are daily XML summaries showing every server sending as your domain, which is how you discover forgotten services before you enforce. The safe rollout is to start at p=none with a rua address, fix SPF and DKIM for every legitimate sender over a few weeks, move to p=quarantine (optionally ramping with pct=25, 50, 100), then p=reject. Since 2024, Google and Yahoo require DMARC for bulk senders, and p=reject is what actually stops attackers spoofing your domain. Honest limits: big providers rarely send forensic (ruf) reports for privacy reasons. Sending reports to another domain requires that domain to authorise it (report services handle this), and raw XML reports are hard to read without a report-analysis service. The SPF record generator and the email header analyzer are related.
Frequently asked questions
What DMARC policy should I start with?
p=none with a rua address, so you receive reports without affecting delivery.
Where do I add the DMARC record?
As a TXT record named _dmarc on your domain, for example _dmarc.example.com.
Is DMARC required?
Google and Yahoo require it for bulk senders since 2024, and it's strongly recommended for every domain that sends email.
Is anything uploaded or fetched?
No. What you paste is processed in your browser, and nothing is fetched, stored or sent.