Version and policy
v=DMARC1 must come first. p tells receivers what to do with mail that fails DMARC: none (just report), quarantine (spam folder) or reject (refuse it). sp sets a different policy for subdomains; if omitted, subdomains follow p.
Free tool · no sign-up
Free DMARC record generator
Build a correct DMARC record for your domain step by step. Choose a policy, add the addresses that should receive reports and copy the TXT record ready to paste into your DNS — with warnings for the mistakes that silently break DMARC.
Runs 100% in your browser — nothing is uploaded
Your DMARC record
- Type
TXT- Host / name
-
_dmarcIf your DNS panel adds the domain automatically, enter only _dmarc.
- Value
-
v=DMARC1; p=nonePublish exactly one TXT record with this value.
Checks
→ Verify after publishing with the free SPF, DKIM & DMARC checker
DNS changes usually show up within minutes.
Authentication is half of deliverability — the other half is your list
Create free account — 200 credits Perfect SPF, DKIM and DMARC do not stop bounces. Sending to invalid, disposable or abandoned addresses hurts your sender reputation just as much. Validate your list before the next campaign.
How to create and publish your DMARC record
- 1
Set up SPF and DKIM first
DMARC builds on SPF and DKIM. Make sure every service that sends as your domain passes at least one of them, with your domain aligned.
- 2
Fill in the form
Start with p=none and a rua address so you receive aggregate reports. The record updates live as you type.
- 3
Publish the TXT record
In your DNS provider, create a TXT record named _dmarc (some panels want _dmarc.yourdomain.com) and paste the value. Keep a single DMARC record.
- 4
Verify and tighten
Check it with our free SPF, DKIM & DMARC checker, read the reports for a few weeks, then move to quarantine and reject.
DMARC tags explained
A DMARC record is a list of tag=value pairs separated by semicolons. Only v and p are required.
Where reports go
rua receives daily aggregate reports (XML) from Gmail, Yahoo, Microsoft and others, listing every IP that sent as your domain. ruf receives per-message failure reports, which few providers send. Several addresses can be listed, comma-separated, each as mailto:.
Alignment
DMARC passes only when SPF or DKIM passes for a domain that matches the visible From domain. Relaxed (r, default) accepts subdomains — mail.example.com aligns with example.com; strict (s) requires an exact match.
Fine tuning
pct applies the policy to a percentage of failing mail, useful for a gradual rollout. fo chooses when failure reports are generated. ri asks for a report interval in seconds, although most providers send one report a day regardless.
A safe DMARC rollout: none → quarantine → reject
Jumping straight to reject can block your own invoices, newsletters or helpdesk mail. Move in stages and let the reports guide you.
- 1
Weeks 1–4 · p=none
Publish p=none with a rua address. Read the aggregate reports (our DMARC report analyzer opens them in your browser) and list every service that sends as your domain.
- 2
Fix every legitimate sender
For each service, set up DKIM with your domain and/or add it to SPF. Repeat until legitimate sources pass DMARC — forwarded mail failing SPF is normal.
- 3
p=quarantine, gradually
Switch to p=quarantine, optionally with pct=25 then 50 and 100. Watch the reports and your support inbox for complaints about missing mail.
- 4
p=reject
When quarantine has run cleanly for a few weeks, move to p=reject. Consider sp=reject too, so nobody can spoof subdomains you do not use.
Keep the rua address after reaching reject — new tools that start sending as your domain will show up in the reports first.
→ DMARC report analyzer — Open DMARC aggregate (RUA) reports — XML, .gz or .zip — and see who sends as your domain.
Frequently asked questions
What is a DMARC record?
A TXT record published at _dmarc.yourdomain that tells receiving servers how to handle messages that claim to come from your domain but fail SPF and DKIM alignment, and where to send reports about them.
Which DMARC policy should I start with?
Start with p=none and a rua address. It changes nothing for delivery but gives you reports on everything sent as your domain. Once all legitimate senders pass, move to p=quarantine (optionally with pct) and finally to p=reject.
Is p=none enough for Gmail, Yahoo and Outlook?
For the bulk-sender rules, yes: Gmail and Yahoo (since February 2024) and Outlook.com (since May 2025) require a valid DMARC record and accept p=none. But p=none does not stop anyone from spoofing your domain — only quarantine or reject do.
Where do I publish the DMARC record?
Create a TXT record with the host/name _dmarc and the generated value. Some DNS panels append your domain automatically (enter _dmarc); others want the full name (_dmarc.yourdomain.com). Never publish two DMARC records — receivers then ignore both.
Can reports go to an address on another domain?
Yes, but the receiving domain must authorize it with a TXT record named yourdomain._report._dmarc.reportdomain containing v=DMARC1. DMARC report services usually publish it for you; if you use your own mailbox on another domain, you must add it there.
Do I need a separate DMARC record for subdomains?
No. Subdomains inherit the policy of the organizational domain (or the sp tag, if set). Publish a record on a subdomain only if it needs a different policy or different reporting addresses.
How long until the record works?
Usually minutes, depending on the TTL of your DNS zone. Aggregate reports arrive about once a day from each provider that received mail from your domain, so expect the first ones within 24–48 hours.
Does this generator store my domain or addresses?
No. The record is built entirely in your browser; nothing you type is sent to our servers.
Protected domain + clean list = inbox
A free account gives you 200 credits to validate lists in bulk, through the REST API or in real time on your forms — so your authenticated mail reaches real people.
Create free account — 200 creditsNo credit card. Credits never expire.