DMARC Record Generator

The DMARC Record Generator creates a valid DMARC TXT record ready to publish in your DNS. No account required. The record is built directly in your browser — nothing is sent to any server.

Tool URL:/tools/dmarc-generator

What is a DMARC record?

A DMARC record is a line of text you add to your domain's DNS settings. It tells email receivers (Gmail, Outlook, Yahoo, etc.) what to do when they receive an email claiming to come from your domain but failing authentication checks. Without a DMARC record, anyone can impersonate your domain and send fraudulent emails.

How to generate your DMARC record

Step 1 — Choose a policy

The policy is the most important setting. It controls what receiving servers do with emails that fail DMARC authentication.

  • None — Monitor only. Emails are delivered normally, but you receive reports. Use this when you are just getting started and want to understand your email traffic before taking action. No emails are blocked.
  • Quarantine — Emails that fail authentication are sent to the spam folder. Use this once you are confident your legitimate email is passing DMARC checks.
  • Reject — Emails that fail authentication are blocked entirely. Use this when you have confirmed all your legitimate senders are properly authenticated. This is the recommended final state for full protection.

If you are unsure, start with None. You can always change the policy later after reviewing reports.

Step 2 — Enter your aggregate report email address (rua)

The Aggregate Report Email (rua) field is where DMARC reports are sent. These reports arrive as XML files summarizing all email sent from your domain over a period (usually 24 hours). They help you identify which senders are passing or failing authentication.

Enter an email address you control, for example dmarc@yourdomain.com. You can use a service like DMARC Examiner to parse these reports automatically — the raw XML files are not easy to read by hand.

This field is optional, but strongly recommended. Without it, you receive no data about your email authentication status.

Step 3 — Copy the generated record

As you fill in the form, the generator builds your DMARC record in real time. You will see it displayed below the form in a box labeled with your record type.

Click the Copy button to copy the full record to your clipboard. The record will look something like this: 

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com;

Step 4 — Add the record to your DNS

Log in to your DNS provider (the service where your domain is registered or where you manage DNS records — this could be GoDaddy, Cloudflare, Namecheap, Route 53, etc.).

  1. Create a new TXT record.
  2. Set the Host / Name field to _dmarc (some providers require you to enter the full subdomain, e.g. _dmarc.yourdomain.com — check your provider's documentation).
  3. Paste the generated record into the Value / Content field.
  4. Save the record.

DNS changes can take up to 48 hours to propagate globally, but often take effect within a few minutes.

Step 5 — Verify your record

Once the DNS record has propagated, use the DMARC Checker to confirm your record is published correctly. Enter your domain name and click "Check DMARC". You will see your record, its policy, and whether it passes validation.

Advanced options

Click Advanced Options in the generator to reveal additional settings. These are optional and have sensible defaults for most domains.

Subdomain policy (sp)

Controls how DMARC applies to subdomains of your domain (e.g. mail.yourdomain.com). By default, subdomains inherit the main policy. Set a different subdomain policy if you want stricter or more permissive behaviour for subdomains.

  • Inherit from policy (default) — Subdomains follow the main policy.
  • None / Quarantine / Reject — Applies the chosen policy to subdomains only.

Percentage (pct)

Applies your policy to only a percentage of failing emails. For example, setting pct=10 with a quarantine policy means only 10% of failing emails are quarantined — the rest are delivered normally.

This is useful for a gradual rollout. Start at 10%, verify no legitimate emails are affected, then increase to 100%. The default is 100%.

Forensic report email (ruf)

Forensic reports provide detailed information about individual emails that failed DMARC. Unlike aggregate reports, these may contain sensitive content. Many receivers no longer send forensic reports due to privacy concerns, so this field is less useful today. Leave it blank unless you have a specific need.

DKIM alignment (adkim) and SPF alignment (aspf)

Alignment controls how strictly the domain in your DMARC record must match the domain used for DKIM signing or the SPF return-path.

  • Relaxed (default) — The organizational domain must match. For example, mail.yourdomain.com aligns with yourdomain.com. This works correctly for most setups.
  • Strict — The domain must match exactly. Only recommended in advanced setups where you need precise control over which subdomains are covered.

Leave both alignment settings at Relaxed unless you have a specific reason to change them.

Common questions

Do I need to sign up to use the generator?

No. The generator is completely free and requires no account. The record is generated locally in your browser.

Can I have more than one DMARC record?

No. DNS allows only one DMARC record per domain. If you already have a DMARC record and want to update it, replace the existing TXT record at _dmarc.yourdomain.com with the new one.

What if I use multiple email providers?

DMARC works at the domain level, not the provider level. All senders using your domain must be properly authenticated (SPF and/or DKIM) before you enforce a quarantine or reject policy. Use the Email Compliance Checker to verify all your senders are configured correctly before tightening your policy.

My emails are being blocked. What should I do?

If you are seeing legitimate emails blocked or quarantined after enabling DMARC, switch your policy back to none immediately. Then review your aggregate reports to identify which senders are failing authentication. The SPF Generator and DKIM Setup Guide can help you fix authentication for each sender before re-enabling enforcement.

Related tools