Free tool · DMARC generator

A DMARC record that you actually understand.

Every tag explained in plain English as you go. We flag the defaults most generators leave dangerously wrong — policy percent, sp= subdomain policy, ADKIM/ASPF strictness.

Basics

Your domain

Apex domain only. The record is published at _dmarc.<domain>.

Policy

What receivers do with mail that fails authentication

Action on failure (p=)

Start at Monitor, move to Quarantine after 2-4 weeks of clean reports, then to Reject. Don't skip stages — you'll break legitimate mail.

Subdomain policy (sp=)

Defaults to inherit from p=. Tighten subdomains independently when a forgotten one might send spoofable mail.

Rollout percent

100%

Only 100% of failing mail gets the policy. Start at 10 when moving to quarantine/reject, then 25, 50, 100. Ignored when p=none.

Reports

Where receivers send DMARC telemetry

Aggregate reports (rua=)

Daily aggregate XML reports — every mailbox provider sends these. Required to get value out of DMARC.

Forensic reports (ruf=)

Per-failure forensic forwards. Optional — most ISPs don't send them for privacy reasons.

Alignment

How strictly From: must match the auth identifiers

DKIM (adkim=)

SPF (aspf=)

relaxed (r) lets subdomains align to the parent. strict (s) requires an exact match. Start with relaxed.

Your DMARC record · RFC 7489

Type

TXT

Host

_dmarc.yourdomain.com

Value

v=DMARC1; p=none

TTL

3600

1 hour. Lower while testing; raise to 86400 once stable.

No rua= address. You won't see any reports. DMARC without a rua is a policy you can't verify.

Publish this as a TXT record on your DNS provider. Once it propagates (minutes to a few hours) your DMARC posture is live.