DMARC Record Generator — Create a Valid DMARC Record for Your Domain
Create a custom DMARC record to protect your domain from spoofing and phishing.
Why You Need a DMARC Record
Every domain that sends email should have a DMARC record. It is the control layer that ties SPF and DKIM together and tells the world what should happen when someone attempts to send unauthorized email from your domain. Without DMARC, even if you have SPF and DKIM configured, there is no policy enforcement — receiving servers may still accept spoofed messages. Major mailbox providers including Google, Yahoo, and Microsoft now require DMARC for bulk senders, and compliance frameworks such as PCI DSS 4.0 mandate DMARC enforcement for organizations handling payment data.
How Our DMARC Generator Works
Our generator walks you through each DMARC tag with plain-language explanations. Start by selecting your policy level — 'none' for initial monitoring, 'quarantine' for intermediate enforcement, or 'reject' for full protection. Add your aggregate reporting address (rua) so you receive daily XML reports showing who is sending email from your domain. Optionally configure forensic reporting (ruf), subdomain policy (sp), alignment modes, and percentage rollout. The tool validates every input in real time and outputs a ready-to-publish TXT record that you can paste directly into your DNS provider.
Step-by-Step: From Monitoring to Enforcement
We recommend a phased approach to DMARC deployment. Start with p=none and a valid rua address. Monitor aggregate reports for 2 to 4 weeks to identify all legitimate email sources — your primary mail server, marketing platforms, CRM transactional email, support ticket systems, and any other authorized senders. Fix SPF and DKIM alignment for each source. Then use this generator to create an updated record with p=quarantine at pct=10, gradually increasing the percentage as you confirm no legitimate email is affected. Once you reach pct=100 at quarantine with zero false positives, generate your final record at p=reject.
Common Mistakes to Avoid
The most frequent mistake is deploying p=reject without first monitoring aggregate reports — this can block legitimate email from authorized third-party senders that lack proper SPF or DKIM alignment. Other common errors include: forgetting to add external report authorization when the rua address is on a different domain, setting pct to a very low value and forgetting to increase it over time, using strict alignment (adkim=s, aspf=s) prematurely before confirming all senders align at the organizational domain level, and publishing a DMARC record on subdomains that are already covered by the parent domain's sp= tag. Our generator prevents most of these mistakes with built-in validation and contextual warnings.
Tag Reference
The following tags/parameters are checked or generated by this tool:
Tag | Description |
v=DMARC1 | Required protocol version declaration. Must be the first tag in the record. |
p=none | Monitor-only policy. No enforcement action taken. Use during initial deployment to collect data. |
p=quarantine | Intermediate enforcement. Failing messages are treated as suspicious (typically routed to spam/junk). |
p=reject | Full enforcement. Failing messages are blocked by the receiving server. Maximum protection. |
rua=mailto: | Aggregate reporting URI. Specifies where daily XML reports are delivered. Critical for visibility. |
ruf=mailto: | Forensic reporting URI. Receives per-message failure details. Limited mailbox provider support. |
sp= | Subdomain policy override. Set independently from the organizational domain policy. |
pct= | Percentage rollout (1-100). Apply the policy to a subset of traffic during gradual enforcement. |
adkim= | DKIM alignment mode. Relaxed (r) allows subdomain matching. Strict (s) requires exact domain match. |
aspf= | SPF alignment mode. Relaxed (r) or strict (s). Controls From header vs envelope sender matching. |
Frequently Asked Questions
Where do I publish my DMARC record?
Should I start with p=none or p=reject?
What is the rua tag and why is it important?
How long should I stay at p=none?
What is percentage rollout (pct)?
Can I use an external email for rua reports?
Do subdomains need separate DMARC records?
What happens if my DMARC record has syntax errors?
Related Tools
DMARC Record Checker
Verify your DMARC record, check for syntax errors, and test your email security.
Try ToolSPF Record Checker
Check for the 10-lookup limit, syntax errors, and authorized IP addresses.
Try ToolDKIM Record Checker
Verify your DomainKeys Identified Mail public key and selector syntax.
Try Tool