DMARC Record Generator
Set your domain’s email policy and get a ready-to-paste _dmarc record, with every tag explained in plain English.
Build your policy
Your DMARC record
Publish this as a TXT record in your DNS:
What each tag in your record means
What is DMARC?
DMARC (Domain-based Message Authentication, Reporting and Conformance) is the policy layer of email authentication. SPF checks whether a server may send for a domain, and DKIM proves a message was signed by the domain, but neither protects the From address that your readers actually see. DMARC does: it requires that the visible From domain lines up (aligns) with the domain that SPF or DKIM verified, tells receivers what to do when it does not, and sends you reports so you can watch it working.
The three policies, in plain English
- p=none (monitor): nothing is blocked. You simply receive reports showing who sends as your domain and whether they authenticate. Every domain should start here.
- p=quarantine: failing mail is treated as suspicious, which in practice means the spam folder. Use this once your reports show all genuine senders passing.
- p=reject: failing mail is refused during delivery. This is the strongest protection and the end state you are aiming for, because spoofed mail never reaches the inbox at all.
Worked example
A finished record for a business that has completed its rollout looks like this: v=DMARC1; p=reject; rua=mailto:dmarc@example.com; adkim=r; aspf=r published as a TXT record at the host _dmarc. It says: reject anything that fails, keep the default relaxed alignment, and email daily aggregate reports to the dmarc inbox. Our guide covers the journey from monitoring to reject in full: how to set up a DMARC record.
Why reports matter
The rua address is where mailbox providers send daily XML summaries of everything claiming to be your domain: your real services, your website host, and the spoofers. Reading them (most people use a free or cheap report reader that turns the XML into charts) is how you discover the invoicing tool or the old mailing service you forgot to authenticate, before a reject policy blocks it.
Before DMARC: SPF and DKIM
DMARC passes when either SPF or DKIM passes with alignment, so at least one of them must be set up well. If you have not created your SPF record yet, start there with our SPF Record Generator, and turn on DKIM signing inside each service that sends for you.
Frequently asked questions
Where do I publish my DMARC record?
In your DNS as a TXT record with the host _dmarc (some providers want _dmarc.yourdomain.com). One domain can only have one DMARC record, so edit an existing one rather than adding a second.
How long should I stay on p=none?
Long enough to see a full business cycle of reports, usually 2 to 4 weeks. If you send monthly invoices or a monthly newsletter, wait until those have gone out at least once and appear in reports as passing.
What is alignment, and should I use relaxed or strict?
Alignment means the domain in the visible From header matches the domain that SPF or DKIM checked. Relaxed mode, the default, also allows subdomains, so mail sent from news.example.com can align with example.com. Strict mode requires an exact match. Most domains should stay relaxed; strict suits organisations that tightly control their subdomains.
What does the pct tag do?
It applies your policy to only that percentage of failing mail, which makes it a dimmer switch for rollouts: p=quarantine with pct=25 quarantines about a quarter of failures. At pct=100 the tag is the default and can be left out, as this generator does.
I am getting DMARC reports as XML files. What do I do with them?
They are aggregate summaries from mailbox providers listing sending sources, volumes and pass or fail results. Feed them into any DMARC report reader to see them as readable tables, and look for legitimate senders that fail; those are the fixes to make before raising your policy.
Does DMARC stop all phishing that uses my brand?
It stops exact-domain spoofing at providers that enforce it, which is most large ones. It cannot stop lookalike domains such as examp1e.com, so keep an eye on registrations and keep user awareness in the mix.
Will DMARC break my email if I get it wrong?
At p=none, no: nothing is blocked, you only get reports. Damage only becomes possible at quarantine or reject if a genuine sender is not authenticated, which is exactly why the staged rollout exists. Follow the stages and check reports at each step.
More tools for site owners
DMARC builds on SPF, so if that record is missing, create it first with the SPF Record Generator. Then read the full walkthrough: how to set up a DMARC record. Adding AI features to your site? Price them with the AI Token Cost Calculator.
