DMARC Record Generator

Build a valid DMARC TXT record in under a minute. Choose your policy, set reporting addresses, and get a copy-paste record to publish at _dmarc.

What this tool checks

• Policy selection (none, quarantine, reject) with rollout guidance
• Optional separate subdomain policy (sp=)
• Aggregate (rua) and forensic (ruf) report destinations
• Coverage percentage for staged rollouts (pct=)
• DKIM and SPF alignment mode (adkim, aspf)
• Outputs a single-line TXT value ready to publish at _dmarc

Why it matters

Since February 2024, Gmail and Yahoo require DMARC for any sender pushing more than 5,000 messages a day. From 2026 onward, even small senders without DMARC see significantly lower inbox placement. DMARC is also the only protocol that prevents display-name spoofing — the most common phishing vector against your customers and staff.

How to fix what it finds

• Start with p=none and rua= pointing at a mailbox you actually read (or a DMARC reporting service)
• Collect reports for 2–4 weeks and identify every legitimate sender
• Fix SPF and DKIM until reports show 100% alignment for legitimate mail
• Promote to p=quarantine for 2–4 weeks, watching for false positives
• Promote to p=reject — the final, fully protected state
• Publish as a TXT record at `_dmarc.yourdomain.com`

Methodology

A deterministic client-side builder that follows RFC 7489 exactly. We emit tags in the canonical order (v, p, sp, adkim, aspf, pct, rua, ruf, fo) separated by semicolons, with `mailto:` prepended to every reporting address since RFC requires a URI scheme. `fo=1` is set by default because it produces actionable forensic reports without spamming you (only fires when both SPF and DKIM fail). The generator does not call any external service — the record is built entirely in your browser and shown live as you change the inputs. We deliberately recommend starting at p=none because going straight to reject before you have clean reports will block legitimate mail.

Frequently asked questions

What is DMARC?

Domain-based Message Authentication, Reporting, and Conformance. A DNS record telling receiving mail servers what to do when a message fails SPF or DKIM, and where to send aggregated reports about authentication outcomes for your domain.

Should I start with p=reject?

No. Always start with p=none for 2–4 weeks while you read the reports. Going straight to reject often blocks legitimate mail you forgot about (HR system, billing platform, support desk) and is the single biggest cause of DMARC rollback.

Where do I publish the record?

As a TXT record at `_dmarc.yourdomain.com`. For example, if your domain is example.com, the record name is `_dmarc.example.com` and the value is the generated string.

What goes in rua?

An email address (or several, comma-separated) that receives daily aggregate XML reports from every receiver that processed your mail. Use a dedicated mailbox or a DMARC reporting service — the raw XML is hard to read at scale.

Do I need ruf (forensic reports)?

Optional. ruf produces sample failing messages, which are useful for debugging spoofing campaigns but can be large and contain PII. Most domains leave it off; if you set it, ensure the recipient mailbox can handle the volume.

What is the difference between adkim=r and adkim=s?

Relaxed (r) allows alignment between the DKIM signing domain and the From: header at the organisational-domain level (e.g. `mail.example.com` aligns with `example.com`). Strict (s) requires an exact match. Start with relaxed unless you have a specific reason for strict.

How long until reports start arriving?

Aggregate reports arrive once per 24 hours from each major receiver, starting the day after you publish the record and DNS has propagated. Expect the first useful batch within 48 hours of publishing.