How to Generate a DMARC Record for Your Domain

A DMARC record tells receiving mail servers what to do with messages that claim to come from your domain but fail authentication. It builds on SPF and DKIM, ties them together, and gives you reports on who is sending mail as you. Here is how to generate one and roll it out without breaking your own email.

What a DMARC record is

DMARC is a single TXT record published in DNS at _dmarc.yourdomain.com. It is a list of tag and value pairs separated by semicolons. The common tags are:

• v=DMARC1: the version, always first and always this value.
• p=: the policy for failing mail. Use none, quarantine, or reject.
• rua=: a mailto: address that receives aggregate reports.
• pct=: the percentage of failing mail the policy applies to, useful when ramping up.
• sp=: a separate policy for subdomains.
• adkim= and aspf=: alignment mode for DKIM and SPF, r for relaxed or s for strict.

DMARC only works once SPF or DKIM is already passing for your mail, since alignment checks one of those against the visible From address.

Generate your record in three steps

The DMARC Record Generator builds the full TXT string for you so you do not have to memorize the syntax.

1. Open the DMARC Record Generator and set your policy to none to start.
2. Add a rua= address so aggregate reports land in an inbox you watch.
3. Copy the generated record and publish it as a TXT record at _dmarc.yourdomain.com.

It runs entirely in your browser. Nothing about your domain or addresses is sent to a server.

Roll out from monitor to enforce

The safe path is gradual. Starting at p=reject on day one can silently drop legitimate mail that you forgot to authenticate.

• Monitor: publish p=none with rua=. This changes nothing for delivery but starts the reports flowing.
• Quarantine: once reports show your real senders passing, move to p=quarantine, optionally with pct= set low at first.
• Reject: when you are confident, move to p=reject so spoofed mail is refused outright.

Read the aggregate reports at each stage. They reveal forgotten sending services, like a CRM or invoicing tool, before those services break.

Related tools

• SPF Record Generator: build the SPF record DMARC depends on.
• Email Header Analyzer: check why a specific message passed or failed DMARC.
• Security Headers Generator: harden your web responses the same way you harden mail.

Start at p=none, watch the reports, then tighten to reject. Your domain stops being easy to spoof.