DMARC Record Generator

Build a valid DMARC record. Pick a policy, add where reports should go, and copy the result into a TXT record at _dmarc on your domain.

Policy

none (monitor first) quarantine (spam folder) reject (block)

Send aggregate reports to (rua)

Send forensic reports to (ruf, optional)

Apply to what percent of mail? (pct)

Strict alignment (aspf=s, adkim=s)

Your DMARC record

v=DMARC1; p=none

Publish as a TXT record at _dmarc.yourdomain.com. Start with p=none, watch your reports, then move to quarantine and reject. Confirm it with the DMARC checker.

Does this look like more than you wanted?

Publishing the record is the quick part. The work is what comes back: aggregate reports arrive as compressed XML, several a day, from every provider your mail touches, and they are not written to be read by a person.

DMARC Monitor gives you a reporting address to put in rua=, turns those reports into a plain list of who is sending as your domain, and tells you when something new starts. It is $9 a month for one domain and you can stop whenever you like.

Start DMARC Monitor

The builder above stays free, with no account, whether you use it or not.

About this tool. DMARC ties SPF and DKIM together and tells receivers what to do with mail that fails authentication. This builder takes you from a safe monitoring policy up to full enforcement step by step, so you can protect your domain from spoofing without blocking your own mail. Verify the published record with the DMARC checker.

How to build and roll out your DMARC record

Make sure SPF and DKIM are already set up and passing for your domain — DMARC builds on both.
Start with policy p=none. This monitors without affecting delivery, so you can watch the reports and confirm your legitimate mail passes.
Add a reporting address (rua=) so you receive the aggregate reports that show who is sending as your domain.
Once the reports show your real senders pass, tighten to p=quarantine, then p=reject for full protection against spoofing.
Publish the record as a TXT record at _dmarc.yourdomain.com. Only one DMARC record is allowed per domain.

Common problems and how to fix them

Legitimate mail started failing after I set p=reject

You moved to enforcement before every sender was aligned. Drop back to p=none, use the reports to fix any failing sources (add them to SPF or enable DKIM), then re-tighten gradually.

I am not receiving DMARC reports

Check the rua= address is correct and can receive external mail. Reports arrive daily as compressed XML; a monitoring dashboard makes them readable.

What percentage should I enforce?

Leave pct at 100 for real protection. Lowering pct only applies the policy to a fraction of mail and leaves the rest spoofable.

Common questions.

What is a DMARC record?

DMARC is a DNS TXT record at _dmarc.yourdomain that tells receiving servers what to do with mail that fails SPF and DKIM, and where to send reports. It is what stops others spoofing your domain.

Is the DMARC generator free?

Yes, free and no signup. It builds a valid record in your browser that you can paste into DNS.

What policy should I start with?

Always start with p=none to monitor safely, then move to quarantine and finally reject once your legitimate senders pass.

Where does the DMARC record go?

As a TXT record with the host _dmarc, so the full name is _dmarc.yourdomain.com.

How do I read DMARC reports?

Aggregate reports are compressed XML that is hard to read by hand. MailArrive's DMARC monitoring turns them into a plain dashboard of who is sending as you and what is passing.

DMARC Checker SPF Generator DKIM Checker Full email checkup

Does this look like more than you wanted?

Start DMARC Monitor

The builder above stays free, with no account, whether you use it or not.