DMARC Record Generator

The DMARC Record Generator creates a valid DMARC TXT record ready to publish in your DNS. No account required. The record is built directly in your browser — nothing is sent to any server.

Tool URL:/tools/dmarc-generator

What is a DMARC record?

A DMARC record is a line of text you add to your domain's DNS settings. It tells email receivers (Gmail, Outlook, Yahoo, etc.) what to do when they receive an email claiming to come from your domain but failing authentication checks. Without a DMARC record, anyone can impersonate your domain and send fraudulent emails.

How to generate your DMARC record

Step 1 — Choose a policy

The policy is the most important setting. It controls what receiving servers do with emails that fail DMARC authentication.

  • None — Monitor only. Emails are delivered normally, but you receive reports. Use this when you are just getting started and want to understand your email traffic before taking action. No emails are blocked.
  • Quarantine — Emails that fail authentication are sent to the spam folder. Use this once you are confident your legitimate email is passing DMARC checks.
  • Reject — Emails that fail authentication are blocked entirely. Use this when you have confirmed all your legitimate senders are properly authenticated. This is the recommended final state for full protection.

If you are unsure, start with None. You can always change the policy later after reviewing reports.

Step 2 — Enter your aggregate report email address (rua)

The Aggregate Report Email (rua) field is where DMARC reports are sent. These reports arrive as XML files summarizing all email sent from your domain over a period (usually 24 hours). They help you identify which senders are passing or failing authentication.

Enter an email address you control, for example dmarc@yourdomain.com. You can use a service like DMARC Examiner to parse these reports automatically — the raw XML files are not easy to read by hand.

This field is optional, but strongly recommended. Without it, you receive no data about your email authentication status.

Step 3 — Copy the generated record

As you fill in the form, the generator builds your DMARC record in real time. You will see it displayed below the form in a box labeled with your record type.

Click the Copy button to copy the full record to your clipboard. The record will look something like this: 

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com;

Step 4 — Add the record to your DNS

Log in to your DNS provider (the service where your domain is registered or where you manage DNS records — this could be GoDaddy, Cloudflare, Namecheap, Route 53, etc.).

  1. Create a new TXT record.
  2. Set the Host / Name field to _dmarc (some providers require you to enter the full subdomain, e.g. _dmarc.yourdomain.com — check your provider's documentation).
  3. Paste the generated record into the Value / Content field.
  4. Save the record.

DNS changes can take up to 48 hours to propagate globally, but often take effect within a few minutes.

Step 5 — Verify your record

Once the DNS record has propagated, use the DMARC Checker to confirm your record is published correctly. Enter your domain name and click "Check DMARC". You will see your record, its policy, and whether it passes validation.

Advanced options

Click Advanced Options in the generator to reveal additional settings. These are optional and have sensible defaults for most domains.

Subdomain policy (sp)

Controls how DMARC applies to subdomains of your domain (e.g. mail.yourdomain.com). By default, subdomains inherit the main policy. Set a different subdomain policy if you want stricter or more permissive behaviour for subdomains.

  • Inherit from policy (default) — Subdomains follow the main policy.
  • None / Quarantine / Reject — Applies the chosen policy to subdomains only.

Non-existent subdomain policy (np)

Applies only to subdomains that do not exist in DNS, such as random123.yourdomain.com. Nobody sends legitimate mail from them, so np=reject is safe even while your main policy is still none. If you leave it unset, receivers use sp, or p when sp is not set.

Testing mode (t=y)

RFC 9989 (May 2026) removed the old pct percentage tag and replaced it with t=y. With testing mode on, receivers apply your policy one level below the one you publish: p=reject is handled as quarantine, and p=quarantine as none. Aggregate reports keep arriving as usual.

Use it to move to a stricter policy step by step: publish the new policy with t=y, watch your reports, then remove t=y. Receivers that still follow the older RFC 7489 ignore t and apply the policy as published.

Forensic report email (ruf)

Forensic reports provide detailed information about individual emails that failed DMARC. Unlike aggregate reports, these may contain sensitive content. Many receivers no longer send forensic reports due to privacy concerns, so this field is less useful today. Leave it blank unless you have a specific need.

DKIM alignment (adkim) and SPF alignment (aspf)

Alignment controls how strictly the domain in your DMARC record must match the domain used for DKIM signing or the SPF return-path.

  • Relaxed (default) — The organizational domain must match. For example, mail.yourdomain.com aligns with yourdomain.com. This works correctly for most setups.
  • Strict — The domain must match exactly. Only recommended in advanced setups where you need precise control over which subdomains are covered.

Leave both alignment settings at Relaxed unless you have a specific reason to change them.

Common questions

Do I need to sign up to use the generator?

No. The generator is completely free and requires no account. The record is generated locally in your browser.

Can I have more than one DMARC record?

No. DNS allows only one DMARC record per domain. If you already have a DMARC record and want to update it, replace the existing TXT record at _dmarc.yourdomain.com with the new one.

What if I use multiple email providers?

DMARC works at the domain level, not the provider level. All senders using your domain must be properly authenticated (SPF and/or DKIM) before you enforce a quarantine or reject policy. Use the Email Compliance Checker to verify all your senders are configured correctly before tightening your policy.

My emails are being blocked. What should I do?

If you are seeing legitimate emails blocked or quarantined after enabling DMARC, switch your policy back to none immediately. Then review your aggregate reports to identify which senders are failing authentication. The SPF Generator and DKIM Setup Guide can help you fix authentication for each sender before re-enabling enforcement.

Related tools