Free DMARC Record Generator
Until a DMARC record exists in your DNS, anyone can send email claiming to be your domain - and receiving servers have no instruction to stop it. This free DMARC record generator puts the form in front of you on page load: choose a policy, add a reporting address, and copy a valid TXT record. No signup, no captcha, and no lookup required to start. If you are updating a record rather than writing your first one, enter your domain and select Load My Record - the tool pulls your current tags into the form through a DNS query that runs in your own browser and never reaches our servers.
What You Get From This Tool
Every Policy, Reporting, and Alignment Tag in One Form
p), subdomain policy (sp), aggregate reports (rua), failure reports (ruf), failure reporting options (fo), and SPF/DKIM alignment (aspf, adkim) are all visible fields - plus the legacy pct, ri, and rf tags for records that still carry them. RFC 9989 deprecated those last three in May 2026, and the defaults here never add them, so a record built from the defaults is already clean under the new standard. Use it as a full DMARC record builder, not a two-field shortcut.Start Without a Lookup
The form is ready on page load. Choose a policy, add a report address, and select Generate DMARC - that is a complete, publishable record. Looking a domain up first is optional, for when you are editing a record that already exists: select Load My Record and the published tags fill the form, making this a record creator and a record editor in one.
A Lookup That Stays in Your Browser
When you do load an existing record, the DNS query runs in your browser, straight to a public DNS resolver. The domain you type never reaches our servers, and there is no anti-bot check standing between you and the result.
Guided Choices with Safe Defaults
Each policy option explains what it does before you commit to it - the guidance of a DMARC wizard without a locked step sequence. The defaults follow standard rollout practice - monitor first, enforce later - so if you only fill in a reporting address, you still leave with a valid record. Optional tags sit behind Advanced Options where they cannot trip up a first-timer.
Copy-Ready for Any DNS Provider
_dmarc host name, ready to paste into GoDaddy, Cloudflare, Namecheap, Route 53, or any other DNS console. No proprietary format, no CNAME delegation to a third-party service, no watermark, and no vendor lock-in.How to Create a DMARC Record
Select Your Policy and Reporting Address
none monitors without affecting delivery, quarantine sends failing mail to spam, and reject blocks it outright. Add the mailbox where aggregate reports should be delivered. If you are editing a record your domain already publishes, enter the domain and select Load My Record first - the current tags fill the form so you change one value instead of rebuilding the record.Adjust Optional Tags and Generate
Open Advanced Options only if you need them: subdomain policy, alignment strictness, failure reporting. The generated record updates as you make each selection. Select Generate DMARC and copy the finished TXT value.
Add the Record to Your DNS
_dmarc - most panels append your domain automatically, so entering the full _dmarc.example.com publishes the record at _dmarc.example.com.example.com. Paste the generated value and save. Records typically propagate within an hour. To confirm it has taken effect, run your domain through our DMARC Checker Tool, which validates the published record against 20 automated tests.Choosing Your Rollout Path
p=none and read the reports for one to two weeks; fix any legitimate senders that fail SPF or DKIM. Move to p=quarantine, watch for problems, then finish at p=reject once the reports are clean. Older guides recommend ramping with the percentage tag (pct=25, then 50, then 100) - RFC 9989 removed pct in May 2026 because receivers applied it inconsistently, so treat report data, not percentages, as your ramp control. Regenerate the record at each stage, update the single TXT value in your DNS, and the new policy takes effect on propagation.Example DMARC Records Explained
A DMARC record example for a domain just starting out looks like this:
v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com;v=DMARC1 declares the version, p=none tells receivers to monitor and report but deliver mail normally, and rua is where daily aggregate reports are sent. This is the record to publish first, it changes nothing about delivery while showing you exactly who is sending mail as your domain.A fully enforced record looks like this:
v=DMARC1; p=reject; sp=reject; rua=mailto:dmarc-reports@yourdomain.com; adkim=s; aspf=s;p=reject), subdomains inherit the same enforcement (sp=reject), and both DKIM and SPF alignment are strict (adkim=s, aspf=s). You may see older examples carrying pct=100; the percentage tag was deprecated by RFC 9989 and full enforcement is the default, so leave it out. Publish a record like this only after your monitoring reports show every legitimate sender passing authentication.Frequently Asked Questions
Yes. DMARC works on top of SPF and DKIM. SPF checks if emails come from approved servers. DKIM adds digital signatures to verify emails are real. DMARC looks at these results and applies your policy. Set up SPF and DKIM first, then add DMARC record.
Always start with p=none. This is monitor-only mode and doesn't affect email delivery. You get reports but nothing gets blocked. Run this for a week or two, check the reports, fix any issues with legitimate senders, then move to p=quarantine. After another monitoring period with no problems, go to p=reject.
No, subdomains automatically inherit your main domain's policy. But if you want different rules for a specific subdomain, you can create a separate DMARC record for it by adding _dmarc.subdomain.yourdomain.com to your DNS with its own policy.
Aggregate reports rua are daily summaries showing stats about all emails - how many passed, how many failed, and from which IP addresses. Failure reports (ruf) are detailed, per-message reports about specific failures that come in real-time. Most people only need aggregate reports since forensic reports can be limited by privacy policies and many providers don't send them.
It is a single line starting with v=DMARC1; followed by tag-value pairs separated by semicolons, published as a TXT record at the _dmarc host of your domain. Only v and p are required. rua, ruf, sp, fo, aspf, and adkim are optional and default to standard values when omitted. Three more tags - pct, ri, and rf - are still accepted by receivers but were deprecated by RFC 9989 in May 2026, so leave them out of new records.