DMARC Generator

⚙ DNS & authentication

Build a valid DMARC record from a few choices — with guidance on rolling out safely from monitoring to enforcement.

No sign-up required Runs on our own infrastructure Also available via API
Your DMARC record
Host/name: _dmarc.yourdomain.com
Type: TXT
Value: v=DMARC1; p=none

Monitoring mode — collects reports without affecting delivery. Start here, review reports for a few weeks, then tighten.

DMARC is the record that finally makes SPF and DKIM mean something. On their own, those two tell a receiver whether a message authenticated — but they don’t say what to do if it didn’t, and they don’t check that the authenticated domain matches the one the reader actually sees. DMARC does both: it ties authentication to the visible From: address and tells receivers to quarantine or reject anything that fails. It also sends you reports, which is the part people underuse. Published carelessly it can bounce your own mail; published in stages it’s the single most effective anti-spoofing control you have. The standard is RFC 7489, and dmarc.org has good background.

What the tags mean

  • p= — the policy for the domain: none (monitor only), quarantine (send failures to spam), or reject (refuse them outright). This is the lever everything else supports.
  • rua= — where aggregate reports go (e.g. mailto:dmarc@yourdomain.com). These daily XML summaries are how you discover who’s sending as you.
  • ruf= — where forensic/failure reports go. Fewer receivers send these, and they can contain message content, so many operators leave ruf off for privacy.
  • pct= — the percentage of mail the policy applies to. Setting pct=25 at quarantine lets you ramp enforcement gradually instead of all at once.
  • sp= — a separate policy for subdomains. Useful when you want reject on the org domain but a looser stance on subdomains, or vice versa.
  • adkim= / aspf= — alignment mode, r (relaxed) or s (strict), for DKIM and SPF respectively. Relaxed allows subdomains to align; strict requires an exact match.

Alignment is the whole point

A message can pass SPF or DKIM and still fail DMARC, because DMARC also requires alignment: the domain that authenticated has to match the domain in the visible From: header. SPF aligns on the envelope MAIL FROM; DKIM aligns on the signature’s d=. This is exactly why mail sent through an ESP can authenticate perfectly and still fail DMARC — it’s signed and authorised as the ESP’s domain, not yours. The fix is to have senders authenticate as your domain (custom return-paths and CNAME-delegated DKIM), which is worth confirming with the DKIM Checker.

Roll it out in stages — never jump to reject

  1. Start at p=none with a rua address. This changes nothing about delivery; it just turns on reporting so you can see every source sending as your domain — including the ones you forgot about.
  2. Read the reports until you’re confident every legitimate stream passes and aligns. Feed the aggregate XML into our DMARC monitoring dashboard so you’re reading trends, not raw XML.
  3. Move to quarantine, optionally with pct= below 100 to ramp gradually. Watch the reports for collateral damage.
  4. Finish at p=reject once quarantine has been clean for a while. This is where DMARC actually stops spoofing.

Publishing it

Publish the generated value as a TXT record at _dmarc.yourdomain — one record, at that exact subdomain. Then verify it with the DMARC Checker, and run the full Email Health Check to see SPF, DKIM and DMARC together. If you want proof that real messages land authenticated, the Outbound Deliverability Test reads the receiving side’s Authentication-Results.

Frequently asked questions

Should I start DMARC at p=reject?
No — start at p=none to collect reports without touching delivery, confirm every sender aligns, then ramp to quarantine and finally reject. Jumping to reject risks bouncing your own mail.
What is the difference between rua and ruf?
rua gets daily aggregate XML (who sent as you, pass/fail counts); ruf gets per-message forensic reports that may include content. Most operators rely on rua and skip ruf.
My mail passes SPF and DKIM but DMARC fails — why?
DMARC needs alignment — the authenticated domain must match your From domain. Mail authenticated as your ESP’s domain isn’t aligned. Authenticate as your own domain via custom return-paths and delegated DKIM.
What does pct do in a DMARC record?
pct applies the policy to a fraction of failing mail — pct=25 quarantines a quarter and treats the rest as none. It lets you ramp enforcement gradually while watching the reports.