DMARC Record Generator

Build a correctly formatted DMARC DNS record — set your enforcement policy and report address, and copy a ready-to-use TXT record.

100% Free Runs In Your Browser Copy-Paste Ready

Build Your DMARC Record

Your Domain (optional, for reference)

Policy (what to do with mail that fails DMARC)

None

Monitor only — start here. No effect on delivery, just collects reports.

Quarantine

Failing mail is sent to spam/junk instead of the inbox.

Reject

Failing mail is rejected outright. Use only once reports look clean.

Aggregate Report Email (rua) — where daily/weekly summary reports go

This is how you'll see who is sending mail as your domain. Strongly recommended.

Advanced Options (subdomain policy, alignment, forensic reports, percentage)

Forensic Report Email (ruf) — optional, per-message failure reports

Subdomain Policy (sp)

% of Mail to Apply Policy To (pct)

DKIM Alignment (adkim)

SPF Alignment (aspf)

_dmarc.example.com

v=DMARC1; p=none;

How to add this: Create a new TXT record with the host/name shown above, and paste the TXT value exactly as shown. A domain can only have one DMARC record, at the _dmarc subdomain.

Generated entirely in your browserYour DMARC record is built locally from your inputs — nothing is sent to our servers.

Never transmittedThe record is generated on your device and never leaves your browser.

Nothing storedWe don't log or save any input you use to build this record.

No third-party sharingYour domain details are never shared with ads, trackers, or outside services.

Works offlineSince nothing is sent to a server, this tool keeps working even without an internet connection.

About DMARC Record Generator

What Is a DMARC Generator?

DMARC (Domain-based Message Authentication, Reporting and Conformance) builds on SPF and DKIM, telling receiving mail servers what to do with messages that fail authentication — and gives you visibility into who's sending mail using your domain, including potential spoofing attempts.

How Our DMARC Generator Works

Configure your policy preference (none, quarantine, or reject) and reporting email address, and the tool generates the correctly formatted DMARC DNS TXT record to publish.

How to Use the DMARC Generator

Choose your policy (start with none for monitoring, move to quarantine/reject once confident)
Enter your reporting email address
Click Generate
Publish the generated TXT record in your DNS

Key Features

Correct DMARC record syntax — matches the published standard
Policy guidance built in — choose the right enforcement level for your situation

Who Uses This Tool

Email administrators setting up domain-wide email authentication. Security teams monitoring for domain spoofing attempts.

Frequently Asked Questions

Should I start with a strict reject policy right away?
No — start with a monitoring-only policy (p=none) to review reports first, then move to quarantine or reject once you've confirmed legitimate mail isn't being caught.

Is this tool free?
Yes, generating a DMARC record is completely free.

Frequently Asked Questions

What is DMARC?

DMARC (Domain-based Message Authentication, Reporting and Conformance) is a DNS record that tells receiving mail servers what to do with messages that fail SPF and DKIM checks, and where to send reports about your domain's email traffic.

Do I need SPF and DKIM before setting up DMARC?

Yes — DMARC evaluates whether a message passes SPF or DKIM in alignment with your domain. Without at least one of those configured correctly, your own legitimate mail will fail DMARC checks.

Why start with policy "none"?

Policy "none" has no effect on mail delivery — it only enables reporting, so you can see every service sending mail as your domain before you risk blocking anything legitimate. Move to quarantine, then reject, only after reviewing reports.

What's the difference between rua and ruf?

rua (aggregate reports) are periodic summaries showing pass/fail counts by source — most useful day to day. ruf (forensic reports) are per-message failure reports containing message details; support for ruf has declined industry-wide due to privacy concerns.

What does the pct tag do?

pct lets you apply your policy to only a percentage of failing mail, useful for gradually rolling out quarantine or reject instead of switching all at once. Leave it at 100 once you're confident in your setup.

Relaxed vs strict alignment — which should I use?

Relaxed alignment (the default) allows the domain in the From header to be a subdomain of the SPF/DKIM domain. Strict alignment requires an exact match. Relaxed is fine for most setups; strict is for domains needing tighter control.