DMARC Record Generator - Create a Valid DMARC Record with All 11 Tags
Until a DMARC record exists in your DNS, anyone can send email that claims to come from your domain, and receiving servers have no instructions to stop it. This DMARC record generator builds a valid, copy-ready TXT record from the policy and reporting choices you make in the form. Enter your domain first and the tool looks up any existing DMARC record and pre-fills the generator with your current settings, so updating a policy is as fast as creating one. Every tag in the DMARC specification is exposed, nothing is locked behind a signup, and the record is yours to publish anywhere.
Enter your domain to look for existing record or start creating a new one
What You Get From This Tool
All 11 DMARC Tags in One Form
p), subdomain policy (sp), percentage (pct), reporting interval (ri), aggregate reports (rua), failure reports (ruf), report format (rf), failure reporting options (fo), and SPF/DKIM alignment (aspf, adkim) , every optional tag is a visible field, including ri and rf, which many record wizards leave out. Use it as a full DMARC record builder rather than a two-field shortcut.Existing Record Lookup and Pre-Fill
Enter a domain and the tool queries your live DNS before generating anything. If a DMARC record already exists, its current tags are loaded into the form so you can change one value, tighten a policy, add a report address, without reconstructing the record from scratch. That makes it a record creator and a record editor in one.
Guided Choices with Safe Defaults
Each policy option explains what it does before you commit to it. The defaults follow the standard rollout practice: monitor first, enforce later. If you only fill in your domain and a reporting address, you still leave with a valid, publishable record.
Copy-Ready for Any DNS Provider
_dmarc host name, ready to paste into GoDaddy, Cloudflare, Namecheap, Route 53, or any other DNS console. No proprietary format, no CNAME delegation to a third-party service.Free, No Signup, No Watermark
Generate as many records as you need. Nothing is gated behind an account, and the free DMARC generator output carries no vendor lock-in.
How to Create a DMARC Record
Step 1 - Check Your Current DMARC Record
Enter your domain in the search box at the top. The tool looks up your DNS to see whether a DMARC record is already published. If one exists, the generator pre-fills with your current settings, so you can update the record instead of starting over. If nothing is found, you are creating your first record, start from the defaults.
Step 2 - Select Your Policy and Reporting Options
none monitors without affecting delivery, quarantine sends failing mail to spam, and reject blocks it outright. Add the mailbox where aggregate reports should be delivered, then adjust the optional tags, subdomain policy, percentage, alignment strictness, failure reporting, only if you need them. The generated record updates as you make each selection.Step 3 - Add the Record to Your DNS
_dmarc, paste the generated value, and save. Records typically propagate within an hour. To confirm it has taken effect, run your domain through our DMARC Checker Tool, which validates the published record against 20 automated tests.Example DMARC Records Explained
A DMARC record example for a domain just starting out looks like this:
v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com;v=DMARC1 declares the version, p=none tells receivers to monitor and report but deliver mail normally, and rua is where daily aggregate reports are sent. This is the record to publish first, it changes nothing about delivery while showing you exactly who is sending mail as your domain.A fully enforced record looks like this:
v=DMARC1; p=reject; sp=reject; pct=100; rua=mailto:dmarc-reports@yourdomain.com; adkim=s; aspf=s;p=reject), subdomains inherit the same enforcement (sp=reject), the policy applies to all messages (pct=100), and both DKIM and SPF alignment are strict (adkim=s, aspf=s). Publish a record like this only after your monitoring reports show every legitimate sender passing authentication.Choosing Your Rollout Path
p=none and read the aggregate reports for one to two weeks; fix any legitimate senders that fail SPF or DKIM. Move to p=quarantine, optionally ramping with the percentage tag (pct=25, then 50, then 100) so only part of your mail stream is affected while you watch for problems. Finish at p=rejectonce the reports are clean. The generator's policy options map directly onto this path, regenerate the record at each stage, update the single TXT value in your DNS, and the new policy takes effect on propagation.Frequently Asked Questions
Always start with p=none. This is monitor-only mode and doesn't affect email delivery. You get reports but nothing gets blocked. Run this for a week or two, check the reports, fix any issues with legitimate senders, then move to p=quarantine. After another monitoring period with no problems, go to p=reject.
No, subdomains automatically inherit your main domain's policy. But if you want different rules for a specific subdomain, you can create a separate DMARC record for it by adding _dmarc.subdomain.yourdomain.com to your DNS with its own policy.
Aggregate reports rua are daily summaries showing stats about all emails - how many passed, how many failed, and from which IP addresses. Failure reports rufare detailed, per-message reports about specific failures that come in real-time. Most people only need aggregate reports since forensic reports can be limited by privacy policies and many providers don't send them.
It is a single line starting with v=DMARC1; followed by tag-value pairs separated by semicolons, published as a TXT record at the _dmarc host of your domain. The only required tags are v and p; everything else, rua, ruf, sp, pct, ri, rf, fo, aspf, adkim, is optional and defaults to standard values when omitted.