Build a valid DMARC record. Pick a policy, add where reports should go, and copy the result into a TXT record at _dmarc on your domain.
v=DMARC1; p=none
Publish as a TXT record at _dmarc.yourdomain.com. Start with p=none, watch your reports, then move to quarantine and reject. Confirm it with the DMARC checker.
About this tool. DMARC ties SPF and DKIM together and tells receivers what to do with mail that fails authentication. This builder takes you from a safe monitoring policy up to full enforcement step by step, so you can protect your domain from spoofing without blocking your own mail. Verify the published record with the DMARC checker.
How to build and roll out your DMARC record
Make sure SPF and DKIM are already set up and passing for your domain — DMARC builds on both.
Start with policy p=none. This monitors without affecting delivery, so you can watch the reports and confirm your legitimate mail passes.
Add a reporting address (rua=) so you receive the aggregate reports that show who is sending as your domain.
Once the reports show your real senders pass, tighten to p=quarantine, then p=reject for full protection against spoofing.
Publish the record as a TXT record at _dmarc.yourdomain.com. Only one DMARC record is allowed per domain.
Common problems and how to fix them
Legitimate mail started failing after I set p=reject
You moved to enforcement before every sender was aligned. Drop back to p=none, use the reports to fix any failing sources (add them to SPF or enable DKIM), then re-tighten gradually.
I am not receiving DMARC reports
Check the rua= address is correct and can receive external mail. Reports arrive daily as compressed XML; a monitoring dashboard makes them readable.
What percentage should I enforce?
Leave pct at 100 for real protection. Lowering pct only applies the policy to a fraction of mail and leaves the rest spoofable.
Common questions.What is a DMARC record?
DMARC is a DNS TXT record at _dmarc.yourdomain that tells receiving servers what to do with mail that fails SPF and DKIM, and where to send reports. It is what stops others spoofing your domain.
Is the DMARC generator free?
Yes, free and no signup. It builds a valid record in your browser that you can paste into DNS.
What policy should I start with?
Always start with p=none to monitor safely, then move to quarantine and finally reject once your legitimate senders pass.
Where does the DMARC record go?
As a TXT record with the host _dmarc, so the full name is _dmarc.yourdomain.com.
How do I read DMARC reports?
Aggregate reports are compressed XML that is hard to read by hand. MailArrive's DMARC monitoring turns them into a plain dashboard of who is sending as you and what is passing.