DMARC record generator
DMARC tells other mail servers what to do with email that pretends to come from your domain, and sends you reports about it. Choose your settings to get a record you can paste into your DNS.
The safe way to roll out DMARC
- Set up SPF and DKIM for every service that sends as your domain. DMARC passes only if one of them passes and matches your From domain.
- Start with
p=noneand a report address. Nothing changes for your email; you just get daily reports. - Read the reports for a few weeks. Look for real email that fails, and fix it.
- Move to
p=quarantine, thenp=reject, once everything legitimate passes.
Since 2024, Gmail and Yahoo require bulk senders to have at least a p=none DMARC record.
What each part means
| Tag | Meaning |
|---|---|
v=DMARC1 | Marks this as a DMARC record. Always first. |
p= | The policy: none, quarantine or reject |
rua= | Where daily summary (aggregate) reports are sent |
ruf= | Where reports about individual failures are sent. Few providers send these. |
pct= | The share of failing mail the policy applies to. It was dropped from the updated DMARC standard (RFC 9989, May 2026), which uses a t=y testing flag instead, but many receivers still honor pct for now. |
sp= | A separate policy for subdomains |
adkim=, aspf= | Relaxed (r) lets subdomains match; strict (s) requires an exact domain match |
Reading the reports
Aggregate reports arrive as zipped XML files, one per provider per day. They are hard to read by hand, so many people send them to a free or paid DMARC report service, or to a dedicated mailbox they check occasionally. If your report address is on a different domain from the one you're protecting, that domain must publish a record allowing it to receive reports.
Questions people ask
- Where does the DMARC record go?
- In a TXT record with the host
_dmarc, on the domain you send from. - Will p=none hurt my email?
- No. It only turns on reporting. It changes nothing about how your email is delivered.
- How long until DMARC works?
- Usually a few minutes to an hour after you save the record, depending on your DNS host. Check it with the DMARC checker.