Skip to content
Webmaster Tools
EmailDMARC Record Generator

DMARC Record Generator

Build a DMARC policy record.

Policy (p) · what receivers do with mail that fails DMARC
Enter a whole number from 0 to 100.

Aggregate reports are daily XML summaries from receivers such as Google, Microsoft and Yahoo. Failure (forensic) reports copy individual failing messages; few receivers send them, and they can contain personal data.

Enter a positive whole number of seconds.

Relaxed alignment lets mail signed or sent from a subdomain (mail.example.com) count for example.com; strict needs an exact match. Most receivers send aggregate reports once a day whatever ri says.

Failure report options (fo) · used only with ruf

Your DMARC record

Host
TypeTXT
Value

Some DNS dashboards add the domain to the host for you; there, enter just _dmarc.

Roll it out in stages

  1. Start with p=none and an rua address. Read the reports for 2 to 4 weeks and fix SPF and DKIM for every service that sends as your domain.
  2. Move to p=quarantine, optionally with a low pct you raise to 100, and keep watching the reports.
  3. Finish at p=reject, so spoofed mail is refused outright.

Check the published DMARC, SPF and DKIM records once the record is live.

About the DMARC Record Generator

This tool builds a DMARC record (RFC 7489): the TXT record at _dmarc.<domain> that tells receivers what to do with mail that fails SPF and DKIM alignment, and where to send reports. Choose the policy p (none, quarantine or reject), an optional subdomain policy sp, the percentage pct the policy applies to, aggregate (rua) and failure (ruf) report addresses, strict or relaxed alignment for DKIM (adkim) and SPF (aspf), failure report options fo and the report interval ri.

Tags at their defaults (pct=100, relaxed alignment, ri=86400) are omitted. Report addresses are checked and written as mailto: URIs. When reports go to a domain other than your own, the tool shows the authorization record that domain must publish, <yourdomain>._report._dmarc.<theirdomain> with the value v=DMARC1, or receivers won't send to it.

How to use it

  1. Enter your domain.
  2. Start with p=none and an aggregate report address.
  3. Adjust the other tags if you need to.
  4. Create a TXT record at _dmarc.<domain> with the value shown.
  5. Once it's live, check it with the email checker.

Examples

Common questions

How should I roll out DMARC?

In stages. Run p=none for a few weeks and read the aggregate reports, fix SPF and DKIM for every legitimate sender, move to p=quarantine (optionally with a lower pct), then finish at p=reject.

Does DMARC need both SPF and DKIM?

It passes when either one passes and aligns with the From domain. Set up both: forwarding often breaks SPF, while DKIM survives it.

What does pct do?

With pct=25, the policy applies to a quarter of failing mail; the rest is treated one level lower, so reject falls back to quarantine.