Free tool · Deliverability DMARC Record Generator
Create a valid DMARC record with the settings that actually matter (policy, reporting, and alignment) and skip the tag-syntax trivia. Built-in guidance keeps you from the classic mistake of enforcing before you've monitored.
Policy: what receivers do with failing mail
DMARC in one paragraph
SPF and DKIM prove where mail came from; DMARC is the policy that tells receivers what to do when those checks fail, and, crucially, it's the only one of the three that sends you reports. Publish it once at _dmarc.yourdomain.com and every major mailbox provider starts telling you who is sending as your domain.
The ramp: none → quarantine → reject
Every healthy DMARC rollout follows the same three steps. Publish p=none with a rua address and change nothing else. Read the reports for a few weeks. Every legitimate tool you forgot to authenticate will show up as a failing source. Fix those (usually a missing SPF include or an unsigned DKIM key), then tighten to quarantine, then reject. The pct slider lets you enforce gradually: pct=25 applies the policy to a quarter of failing mail while you build confidence.
Why reporting is the whole point
A DMARC record without rua is a policy you can never safely tighten, because you have no idea what it would break. The reports are XML files that arrive daily from each provider, unreadable by hand at any volume, which is why we built the DMARC report analyzer to turn them into a source-by-source pass/fail table in your browser.
After you publish
Verify the live record with the DMARC checker, then run the full deliverability test to see SPF, DKIM, DMARC, and MX in one score. Setting this up correctly across every sending domain, and actually watching the reports, is part of how we run cold email infrastructure for clients. For the deeper why, read the SPF, DKIM & DMARC guide for cold email.
Frequently asked questions
How do I create a DMARC record?
Enter your domain and a reporting address above, pick a policy, and copy the generated record. Publish it as a TXT record at host "_dmarc" (so the full name is _dmarc.yourdomain.com) in your DNS dashboard. Within a day or two, mailbox providers start emailing aggregate reports to your rua address showing exactly who is sending as your domain.
Which DMARC policy should I start with: none, quarantine, or reject?
Start with p=none plus a rua reporting address. It changes nothing about mail delivery but gets you reports on every source sending as your domain. After 2–4 weeks, when reports show all your legitimate senders passing, move to p=quarantine, then p=reject. Jumping straight to reject before confirming your senders is the classic way to lose your own legitimate email.
What is the rua tag in a DMARC record?
rua is the address that receives aggregate reports: daily XML summaries from Gmail, Microsoft, Yahoo and others listing every IP that sent mail claiming to be your domain, with SPF/DKIM results and message counts. A DMARC record without rua gives you policy but zero visibility. Use our DMARC report analyzer to read the XML files you receive.
Do Google and Yahoo require DMARC?
Yes: since February 2024, both require a DMARC record (at minimum p=none) for anyone sending 5,000+ messages a day to their users, alongside SPF and DKIM. In practice every serious sender should treat DMARC as mandatory: without it you're increasingly filtered regardless of volume.
Does p=none hurt my deliverability?
No, p=none is a monitoring policy and doesn't affect how your mail is treated. What it does is satisfy the mailbox providers' "has DMARC" requirement and start the reporting flow you need before enforcing. The deliverability upside comes later: enforced policies (quarantine/reject) protect your domain reputation from spoofers.
Keep your outbound landing.
DMARC Checker
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com
"p=none" only monitors. It doesn't protect against spoofing. It's the right place to start; once your reports look clean, move to "quarantine" then "reject".
Read your DMARC policy in plain English, see whether you're protected or just monitoring, and confirm reporting is on.
DMARC Report Analyzer
Paste a DMARC aggregate XML report and get a readable pass/fail table per sending source. Runs in your browser; nothing is uploaded.
SPF Record Generator
v=spf1 include:_spf.google.com include:hubspotemail.net ~all
Pick your email platforms, add any server IPs, and copy a TXT record already checked against the 10-lookup limit.
Want us to build your outbound system?
Skip the DIY. We'll orchestrate your entire outbound operation, on infrastructure registered in your name from day one.
Book your free ICP review →