DMARC record generator

Enter your domain, pick a policy, and we'll build a standards-compliant DMARC record. The default is deliberately p=none: starting straight at reject rejects mail from any service you forgot on day one.

Your domain

What should happen to mail that fails?

p=none — monitor only (recommended start)Nothing is blocked, you just receive reports. Stay here for the first 2-4 weeks: use the reports to find and fix every service sending as you.p=quarantine — send to spamFailing mail lands in the spam folder. The second step, once your reports are clean. Real protection starts here.p=reject — never deliverThe strongest protection and the intended end state. Choose it only once none of your own legitimate services fail in the reports.

Reporting address (rua)

Aggregate reports arrive here. Leave it blank and we'll suggest an address on your domain. Reports are XML and dozens can arrive per day, so a dedicated mailbox or folder helps.

Advanced settings (optional)

Share of mail the policy applies to: 100%

For a phased rollout: apply the policy to a fraction of mail first and watch the effect. Return it to 100% when the rollout is done — left in place it makes your protection misleading.

Separate policy for subdomains (sp)

Leave it unset and subdomains inherit the main policy, which is usually what you want. Choosing 'sp=none' leaves subdomains unprotected — the first place attackers try.

Strict alignment (adkim=s, aspf=s)Default 'relaxed' alignment also accepts sending from a subdomain. Strict alignment requires an exact match; it raises security but breaks services that send from a subdomain, such as marketing tools.

Your DMARC record

v=DMARC1; p=none;

How to add it to DNS

Record type: TXT
Name / Host: _dmarc (the panel appends your domain)
Value: the full record generated above
TTL: 3600 (or the panel default)

The record must be published at '_dmarc'

A DMARC record is published under the '_dmarc' subname, not on the domain itself. The full name is _dmarc.yourdomain.com; in most DNS panels typing just '_dmarc' in the name field is enough — the panel appends the domain.

This is the single most common mistake we see in the field: the record is placed at the apex, shows up in the panel, and the setup looks complete — but since no receiver ever queries there, it has zero effect. After publishing, verify with the DMARC checker; it calls this out explicitly.

Why start at p=none?

Starting straight at 'p=reject' is a risky move. If any service sends as you but isn't listed in SPF or signing with DKIM — a billing system, payroll, appointment reminders, an old marketing tool — its mail starts being rejected the moment the record goes live.

Starting at 'none' buys you visibility: reports start flowing, you see who sends as your domain, and you fix the gaps. But 'none' is not protection; staying there is using half of DMARC. The goal is to reach quarantine within a few weeks, then reject.

What are the reports for?

Aggregate reports sent to your 'rua' address list every source sending as your domain, by IP, with the SPF and DKIM result for each. Most companies discover long-forgotten services in these reports.

Reports are XML and not meant to be read by hand. For a small domain, filing them in a folder may be enough; for real monitoring you'll want a DMARC reporting service. Keeping the address on your own domain is simplest — pointing it at another domain requires that domain to publish an authorisation record accepting reports for you.

Frequently asked questions

How do I create a DMARC record?

At minimum you need two tags: 'v=DMARC1' and a 'p=' policy. Adding a reporting address ('rua=mailto:...') is strongly recommended. The tool on this page builds the record for you; copy it and publish it as a TXT record named '_dmarc' in your DNS panel.

What name should the record use?

'_dmarc'. The full name becomes _dmarc.yourdomain.com. Published at the apex instead, the record does nothing at all.

How long should I stay at p=none?

Usually 2-4 weeks. Once the reports show every legitimate service sending as you, and all of them pass SPF or DKIM, you can move to quarantine.

Should I use the pct tag?

Only during a rollout. It's useful for applying the policy to a fraction of mail first and watching the effect. Remove it once you're done — the default is already 100%.

What should I do about subdomains?

Nothing — subdomains inherit the main policy automatically. Use 'sp=' only if you want a different policy for them. Setting 'sp=none' leaves them unprotected.