DMARC Record Generator
Create a valid DMARC record with the settings that actually matter — policy, reporting, and alignment — and skip the tag-syntax trivia. Built-in guidance keeps you from the classic mistake of enforcing before you've monitored.
Policy — what receivers do with failing mail
DMARC in one paragraph
SPF and DKIM prove where mail came from; DMARC is the policy that tells receivers what to do when those checks fail — and, crucially, it's the only one of the three that sends you reports. Publish it once at _dmarc.yourdomain.com and every major mailbox provider starts telling you who is sending as your domain.
The ramp: none → quarantine → reject
Every healthy DMARC rollout follows the same three steps. Publish p=none with a rua address and change nothing else. Read the reports for a few weeks — every legitimate tool you forgot to authenticate will show up as a failing source. Fix those (usually a missing SPF include or an unsigned DKIM key), then tighten to quarantine, then reject. The pct slider lets you enforce gradually — pct=25 applies the policy to a quarter of failing mail while you build confidence.
Why reporting is the whole point
A DMARC record without rua is a policy you can never safely tighten, because you have no idea what it would break. The reports are XML files that arrive daily from each provider — unreadable by hand at any volume, which is why we built the DMARC report analyzer to turn them into a source-by-source pass/fail table in your browser.
After you publish
Verify the live record with the DMARC checker, then run the full deliverability test to see SPF, DKIM, DMARC, and MX in one score. Setting this up correctly across every sending domain — and actually watching the reports — is part of how we run cold email infrastructure for clients. For the deeper why, read the SPF, DKIM & DMARC guide for cold email.
Frequently asked questions
Enter your domain and a reporting address above, pick a policy, and copy the generated record. Publish it as a TXT record at host "_dmarc" (so the full name is _dmarc.yourdomain.com) in your DNS dashboard. Within a day or two, mailbox providers start emailing aggregate reports to your rua address showing exactly who is sending as your domain.
More free tools