DMARC Generator
Build a DMARC record with a guided form.
v=DMARC1; p=rejectQuick answer
This tool builds a DMARC DNS record from a guided form, letting you set your policy (none, quarantine, or reject) and the address that receives authentication reports. It produces a ready-to-publish TXT record that tells receivers how to handle mail failing SPF and DKIM checks.
The DMARC Generator builds a valid DMARC TXT record from a short, guided form so you don't have to memorize tag syntax. You pick a policy, add the mailboxes that should receive reports, and set alignment and percentage options; the tool assembles the exact string you publish at _dmarc.yourdomain.com. DMARC tells receiving servers what to do with mail that fails SPF and DKIM, and it turns on reporting so you can see who is sending as your domain. Getting the record right is what stops spoofed mail from reaching inboxes.
How to use it
Start by choosing a policy in the p tag: none only monitors, quarantine sends failing mail to spam, and reject blocks it outright. Enter an rua address (like [email protected]) to receive daily aggregate reports. Optionally set pct to roll out enforcement gradually, choose relaxed or strict alignment for SPF and DKIM, and add a subdomain policy. The tool outputs one line; copy it into a TXT record named _dmarc on your DNS host.
Common problems & fixes
The record must live at the _dmarc subdomain, not the root domain, and the host must return it as a single TXT string. Jumping straight to p=reject before SPF and DKIM are aligned will bounce your own legitimate mail, so begin with p=none and read the reports first. A missing rua means you get no visibility at all. Also confirm you have only one DMARC record; multiple records cause receivers to ignore the policy entirely.
Why it matters
SPF and DKIM authenticate mail, but neither tells a receiver what to do when checks fail, and neither shows you who is abusing your domain. DMARC closes both gaps. A published policy lets banks, Gmail, and Microsoft reject forged messages carrying your domain, protecting recipients from phishing. The aggregate reports reveal shadow senders, misconfigured services, and forwarding issues you would otherwise never notice until deliverability dropped.
Frequently asked questions
- Do I need SPF and DKIM before adding DMARC?
- Yes. DMARC evaluates whether a message passed SPF or DKIM and whether those results align with the From domain. Without at least one of them configured and aligned, every message fails DMARC. Publish and verify SPF and DKIM first, then add a DMARC record with p=none to observe results before enforcing anything.
- What is the difference between quarantine and reject?
- With p=quarantine, mail that fails DMARC is still delivered but pushed to the spam or junk folder, so recipients can still find false positives. With p=reject, the receiving server refuses the message during the SMTP transaction and it never arrives. Reject is the strongest protection, but only move to it once your reports confirm legitimate mail passes.
- Where do the reports in the rua tag go?
- Receiving mail providers send XML aggregate reports, usually once per day, to the address in your rua tag. Each report lists sending IPs, message counts, and SPF/DKIM/DMARC results for your domain. The raw XML is hard to read by hand, so most people point rua at a DMARC reporting service that parses and charts the data for them.