How do I generate a DMARC record for my domain?

Choose your policy and reporting options in the DMARC Record Generator to build a valid _dmarc TXT record to publish in DNS.

What policy should I start with?

Start with p=none to collect aggregate reports without affecting delivery. Move to quarantine, then reject, once reports confirm all legitimate senders pass SPF or DKIM alignment.

Where do DMARC reports go?

Aggregate reports go to the address in the rua tag and forensic reports to ruf. Use a dedicated mailbox or a DMARC report processing service, as high-volume domains receive many reports.

What is the pct tag for?

The pct tag applies the policy to only a percentage of failing messages, letting you ramp up enforcement gradually — for example, pct=25 while you verify legitimate senders.

DNS & NETWORK TOOLS · FREE ONLINE TOOL

DMARC Record Generator

Build a correct DMARC DNS record with a guided formHand-typing a DMARC record is exactly how typos end up in DNS. One misspelled tag or stray space, and servers ignore the entire policy. This generator produces a correctly formatted record ready to paste into your DNS zone.

✓ Free to use✓ No sign-up✓ Ready in your browser

// DMARC RECORD GENERATOR · GET STARTED

Use DMARC Record Generator

Build a correct DMARC DNS record with a guided form

Domain

DMARC policy

Monitoring only. Failed mail is delivered normally, but you receive reports.

Subdomain policy

Policy percentage (1-100)

Aggregate report email (rua)

Forensic report email (ruf, optional)

DKIM alignment

SPF alignment

Your DMARC record

v=DMARC1; p=none; pct=100; adkim=r; aspf=r; fo=1; ri=86400;

How to publish: add a TXT record at _dmarc.yourdomain.com with the value above. Changes usually take effect within a few hours, depending on your DNS TTL.

What each tag means

v v=DMARC1 identifies the record as DMARC version 1.
p p is the policy for your main domain: what receivers do with mail that fails DMARC.
sp sp is the policy for subdomains. "Inherit" means subdomains follow the main policy.
pct pct is the percentage of failing mail the policy applies to (100 = all of it).
rua rua is where providers send daily aggregate XML reports about your mail.
ruf ruf is where forensic failure reports for individual messages are sent.
adkim adkim sets DKIM alignment: relaxed allows subdomains, strict requires an exact domain match.
aspf aspf sets SPF alignment: relaxed allows subdomains, strict requires an exact domain match.
fo fo controls when failure reports are generated (1 = any authentication failure).
ri ri is how often aggregate reports are sent, in seconds (86400 = daily).

// DMARC RECORD GENERATOR · AT A GLANCE

DMARC Record Generator: what to know first.

Build a correct DMARC DNS record with a guided form

01
DMARC is the policy layer that sits on top of SPF and DKIM: it tells the world what to do with mail that fails authentication, and it gives you visibility through daily reports. Many domains publish SPF and DKIM but never finish the job, leaving spoofed mail to land in inboxes. This generator removes the guesswork by turning your choices into a syntactically valid record, so you never have to memorize tag names or worry about a misplaced semicolon breaking the whole policy.
02
The tool explains every tag it emits in plain language, recommends the safe policy ramp-up (none, then quarantine, then reject), and reminds you to verify SPF and DKIM first. The generated record is ready to paste into any DNS provider, and the report settings help you monitor authentication before you enforce a strict policy.

// DMARC RECORD GENERATOR · HOW IT WORKS

How to use the DMARC Record Generator

Choose policy

Enter your domain and choose a policy (start with none, then quarantine, then reject).

Set reports

Add your report email addresses and pick alignment settings.

Copy and publish

Copy the generated record and add it as a TXT record at _dmarc.yourdomain.com.

// DMARC RECORD GENERATOR · ABOUT THIS TOOL

About the DMARC Record Generator

DMARC sits on top of SPF and DKIM: it tells the world what to do with mail that fails authentication, and it gives you visibility through daily reports.

This generator turns your choices into a valid record, explains every tag in plain language, and recommends the safe policy ramp-up from none to reject.

Where it helps most

Correct syntax on the first try.

DMARC debuts

A domain with no record yet gets a proper monitoring policy with reports pointed at a real mailbox, which is the correct day-one posture.

Enforcement upgrades

When reports show clean authentication, generate the next stage, quarantine at a rising percentage then reject, instead of guessing at syntax.

Gradual rollouts

The percentage of mail the policy applies to is the standard way to roll out enforcement gradually while you watch the reports.

Complex setups

Advanced options expose subdomain policy and the adkim and aspf alignment modes, so the record matches your infrastructure rather than a template.

Building well

The decisions that matter.

Pick the policy

The policy selector walks through p=none for monitoring, p=quarantine for spam-foldering and p=reject for enforcement, with plain explanations of each.

Report addresses

Separate fields collect the aggregate report address (rua) and the forensic address (ruf), plus the percentage the policy applies to.

Verify after publishing

Because the output is a single TXT value, publishing takes one DNS edit, and you can verify the result immediately with the DMARC checker.

DMARC Record Generator: built for trust

Pick your policy, fill in a few fields, and paste the generated TXT value into your DNS in one edit.

// DMARC RECORD GENERATOR · COMMON QUESTIONS

DMARC Record Generator FAQs

What should my first DMARC record look?

Start with p=none and a rua address, for example v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com. This publishes a monitoring policy that collects reports without affecting delivery while you inventory legitimate senders.

What does the pct tag do in a DMARC record?

Where do DMARC aggregate reports go?

Do I need separate DMARC records for subdomains?

tools-guide

WHOIS Lookup: Find Out Who Owns Any Domain Instantly

Free WHOIS lookup for any domain. Check the registrar, registration and expiry dates, name servers and the full WHOIS record instantly, no sign-up needed.

Read article →