DMARC Record Generator - Build Your Policy Record

DMARC tells receiving servers what to do with mail that fails SPF or DKIM for your domain. Pick a policy, add report addresses, and copy the record.

Build your DMARC policy
The record lands on _dmarc.<your domain> and tells receivers what to do with mail that fails SPF or DKIM.

Used only to show where the record gets published. It never appears in the record itself.

Your DMARC record
Copy this into a TXT record at the host below. The tool validates the shape of your input, not live DNS.
_dmarc
v=DMARC1; p=none

Next steps: publish the record as TXT at _dmarc, start with p=none, read the aggregate reports for a week or two, then move to quarantine and finally reject.

How to use

  1. Choose a policy. Start with p=none so failing mail is still delivered while you watch reports.
  2. Add at least one rua address, for example dmarc-reports@example.com. Receiver reports arrive there.
  3. Copy the record and publish it as a TXT record at _dmarc.<domain> with your DNS provider.
  4. Read the aggregate reports, confirm every legitimate source passes, then tighten the policy to quarantine and finally reject.

Frequently asked questions

Are my domain and policy choices uploaded or saved anywhere?

No. Your domain and the policy choices you pick stay in the browser tab, and the tag string is assembled locally. The tool makes no DNS lookups, and nothing is sent to a server, saved on our side, or written to your browser's storage. The site sets no cookies and has no accounts; if an ad is shown, the ad network follows its own policies but still never receives your domain.

What does DMARC add on top of SPF and DKIM?

SPF and DKIM check that a message came from an authorized server. DMARC checks that the visible From domain lines up with those checks and tells receivers what to do when it does not. You publish one DMARC record at _dmarc.<domain> and receivers apply your policy.

Why start with p=none instead of p=reject?

p=none delivers mail that fails the check while you collect reports, so you can find every legitimate sending source first. Switching straight to reject sends legitimate mail from unlisted sources to the spam folder or drops it. Move to quarantine, then reject, once the reports look clean.

What is the difference between aggregate and failure reports?

Aggregate reports (rua) are daily XML summaries of which sources sent mail for your domain and whether it passed. Failure reports (ruf) are copies of individual messages that failed, when the receiver sends them at all. Most receivers only send aggregate reports.

Do Google and Yahoo require DMARC?

Since February 2024, Gmail and Yahoo require senders of 5,000 or more messages a day to their users to publish a DMARC record with at least p=none and a working rua report address.

Can this tool check my DNS?

No. The tool builds the record and validates its structure, then you publish it with your DNS provider and confirm the lookup there.