⚙️ DMARC Record Generator
Generate a DMARC record for your domain step by step. Choose your enforcement level, reporting options and alignment settings, then copy the TXT record.
What is DMARC?
DMARC (Domain-based Message Authentication, Reporting & Conformance) tells receiving mail servers what to do when SPF or DKIM checks fail. It also enables you to receive reports about email authentication.
Recommended Rollout
- Start with p=none — Monitor authentication without affecting delivery
- Analyze reports — Identify legitimate senders and fix authentication issues
- Move to p=quarantine — Start filtering unauthenticated mail
- Finally p=reject — Block all unauthenticated mail
DMARC Tags Explained
A DMARC record is a list of tag=value pairs separated by semicolons. Only v and p are required.
| Tag | Required? | Values | What it does |
|---|---|---|---|
v | Yes, first | DMARC1 | Identifies the record |
p | Yes | none, quarantine, reject | Policy for mail that fails DMARC |
sp | No | none, quarantine, reject | Policy for subdomains; defaults to p |
rua | No (recommended) | mailto: addresses, comma-separated | Where daily aggregate reports go |
ruf | No | mailto: addresses | Where per-message failure reports go; many receivers never send them |
pct | No | 0–100 (default 100) | Share of failing mail the policy applies to |
adkim | No | r (relaxed, default) or s (strict) | DKIM alignment mode |
aspf | No | r (relaxed, default) or s (strict) | SPF alignment mode |
fo | No | 0 (default), 1, d, s | When to send failure reports; only matters with ruf |
ri | No | Seconds (default 86400) | Requested report interval; most receivers send daily regardless |
Example DMARC Records
Publish one of these as a TXT record at _dmarc.example.com, with your own report address.
| Stage | Record |
|---|---|
| Monitor (start here) | v=DMARC1; p=none; rua=mailto:dmarc@example.com |
| Partial enforcement | v=DMARC1; p=quarantine; pct=25; rua=mailto:dmarc@example.com |
| Full enforcement | v=DMARC1; p=reject; rua=mailto:dmarc@example.com |
| Strict alignment | v=DMARC1; p=reject; adkim=s; aspf=s; rua=mailto:dmarc@example.com |
| Different subdomain policy | v=DMARC1; p=reject; sp=quarantine; rua=mailto:dmarc@example.com |
Frequently Asked Questions
What should my first DMARC record be?
v=DMARC1; p=none; rua=mailto:you@yourdomain.com. It doesn't change delivery, but it starts the daily reports, so you can see every service sending as your domain before you enforce anything. Read the reports with the DMARC Report Analyzer.
Where do I add the DMARC record?
As a TXT record on the host _dmarc, i.e. _dmarc.yourdomain.com. Most DNS panels want just _dmarc in the name field. Then confirm it with the DMARC Checker.
Do I need DMARC for Gmail and Yahoo?
Since February 2024 both require bulk senders (roughly 5,000+ messages a day to their users) to publish a DMARC record, at least p=none, alongside SPF and DKIM. Smaller senders aren't required to, but unauthenticated mail is more likely to land in spam.
Can I have more than one DMARC record?
No. If a domain publishes two DMARC records, receivers ignore both and apply no DMARC policy. Merge everything into one record.
Can reports go to an address on another domain?
Yes, but that domain must authorise it with a TXT record at yourdomain.com._report._dmarc.theirdomain.com containing v=DMARC1. Report services set this up for you.