DMARC Record Generator - Free Online Builder

This free DMARC record generator builds a ready-to-publish DMARC TXT record for your domain. Pick a policy (none, quarantine or reject), add report email addresses, adjust alignment settings and copy the result. It is made for domain owners, marketers and IT admins who want to stop spoofing and phishing without writing the syntax by hand.

What Is a DMARC Record?

A DMARC record is a DNS TXT record, published at _dmarc.yourdomain.com, that tells receiving mail servers what to do with messages that claim to come from your domain but fail authentication. It also tells them where to send reports about those messages.

DMARC builds on two older checks. SPF confirms the sending server is allowed to send for a domain. DKIM confirms the message carries a valid signature. DMARC adds alignment: at least one of those checks must pass for a domain that matches the visible From address.

What does a DMARC record look like?

The record is a list of tag=value pairs separated by semicolons. The version tag v=DMARC1 comes first and the policy tag p= comes next. A minimal monitoring record is v=DMARC1; p=none;. Everything else is optional and refines how receivers treat failures and where reports go.

• p= is the policy for your main domain: none, quarantine or reject.
• sp= sets a different policy for subdomains.
• rua= is the mailbox for daily aggregate (summary) reports.
• ruf= is the mailbox for per-failure forensic reports.
• adkim= and aspf= set DKIM and SPF alignment to relaxed (r) or strict (s).

What Is the Difference Between RFC 9989 and RFC 7489 Mode?

RFC 7489 is the original DMARC specification, and RFC 9989 is the current one. The Record standard menu at the top of the tool switches between them and changes which fields appear.

In RFC 9989 (current) mode, the removed pct, rf and ri tags are left out, and you get a Testing (t=) menu instead. Choosing Yes asks receivers to apply one level less strict than your policy: reject is treated as quarantine, and quarantine as none. In RFC 7489 (legacy) mode, the Testing menu is disabled and the Percentage (pct=), Report Format (rf=) and Report Interval (ri=) fields appear. Receivers always decide how to handle a message, so a policy is a request, not a guarantee.

How to Use the DMARC Record Generator

You can build a complete record in about a minute by working through the numbered sections on the page.

1. Choose a Record standard. Keep RFC 9989 (current) unless you specifically need the legacy tags.
2. Under 1. Policy (p=), click None (Monitor), Quarantine (Spam) or Reject (Block). If you are unsure, start with None.
3. Under 2. Reporting, enter an address in Aggregate Reports Email (rua=). Add Forensic Reports Email (ruf=) only if you want per-failure reports.
4. Under 3. Advanced Settings, set Subdomain Policy (sp=), DKIM Alignment (adkim=) and SPF Alignment (aspf=). In current mode you can also set Testing (t=). In legacy mode you can set Percentage, Report Format and Report Interval.
5. Check the Record Value under Generated DMARC Record, then click Copy.
6. In your DNS provider, create a TXT record named _dmarc (or _dmarc.yourdomain.com as the full hostname) and paste the value. Then confirm it is live with a DNS lookup of your TXT records.

The steps are the same whether your mail runs on Google Workspace, Microsoft 365 or another host. Only the place where you paste the record differs.

Worked Example: A Small Online Shop

Say you run northwind-shoes.com and want to start enforcing DMARC carefully. You keep RFC 9989 (current), click Quarantine (Spam), type [email protected] as the aggregate address, and set DKIM Alignment to Strict (s). The tool returns:

v=DMARC1; p=quarantine; t=n; adkim=s; rua=mailto:[email protected];

The DNS Record Name is _dmarc.northwind-shoes.com and the Record Type is TXT. Alignment tags appear only when you change them from relaxed, which is why aspf is missing. If you switch Testing to Yes, the value becomes t=y, asking receivers to go one level softer than quarantine while you check reports.

In RFC 7489 (legacy) mode with Percentage set to 25, the same setup produces v=DMARC1; p=quarantine; pct=25; adkim=s; rua=mailto:[email protected];. The pct tag asks receivers to apply the policy to about a quarter of failing messages. At 100, the tag is left out because 100 is the default.

How Do You Read and Act on the Result?

The generated value is correct when it starts with v=DMARC1, includes your chosen p= and ends with a semicolon. What matters next is whether the policy fits your current setup.

A widely used rollout path is to publish p=none, read the aggregate reports for a few weeks, fix every legitimate sender that fails, then move to quarantine and finally reject. If reports show your own newsletter platform failing, set up DKIM signing for your domain with that platform before you tighten the policy.

Relaxed or strict alignment?

Relaxed (the default) lets a subdomain match the organizational domain, so mail.example.com aligns with example.com. Strict requires an exact domain match. Start relaxed, and use strict only when you control every sending source and want tighter rules.

Who Is This DMARC Record Generator For?

It suits anyone who must publish a DMARC record without memorizing the tag syntax.

• Site owners and marketers who send newsletters and want fewer messages landing in spam.
• IT admins setting up a new domain, or tightening one from none to quarantine.
• Agencies that need a consistent record for each client and want a quick copy-ready value.
• Brand owners protecting a domain from lookalike abuse. Pair DMARC with a domain typo generator to find misspelled domains that attackers could register.

Best Practices, Common Mistakes and Troubleshooting

Most DMARC problems come from rushing to a strict policy or from small formatting errors.

• Jumping straight to reject. Real mail from forgotten services, such as a billing tool or helpdesk, can be blocked. Monitor first.
• Skipping SPF and DKIM. DMARC passes only when one of them passes and aligns. Set both up for every sending service.
• Seeing an error under the form. Each reporting field takes one valid email address. Semicolons, spaces or two addresses in one field trigger the message, and Copy stays disabled until you fix it.
• Needing several report addresses. Generate the record with one, then add more in your DNS, separated by commas, each starting with mailto:.
• Using a report mailbox on another domain. The receiving domain must publish permission for your reports, or some receivers will not send them.
• Percentage error in legacy mode. Enter a whole number from 0 to 100.
• Creating two DMARC records. A domain should have only one TXT record at _dmarc. Edit the existing one instead of adding another.
• Pasting the wrong name. Many DNS panels add your domain automatically, so enter only _dmarc there.

Allow time for DNS changes to spread, then verify the record. If your deliverability drops after tightening, check whether your domain or sending IP is listed with the blacklist checker, because a blocklist problem can look like a DMARC problem.

Limitations to Keep in Mind

The tool creates the record text. It does not publish the record to your DNS, test your SPF or DKIM setup, or read your incoming reports. It also cannot force receivers to follow your policy, since each mailbox provider makes its own decision.

Forensic reports (ruf) are optional, and many receivers do not send them because they can contain message details. Rely on aggregate reports (rua) for day-to-day monitoring. If you manage many domains, you can keep the Domain Tools category handy for related checks.

With the generator on this page, you can go from a blank field to a valid, copy-ready DMARC record in minutes. Choose a policy, add a report address, copy the value and publish it as a TXT record. Then start reading your reports.