DMARC Generator
Build a valid DMARC record from a simple form.
Build a valid DMARC record for your domain, then copy and paste it into your DNS. Start at p=none to watch your mail without blocking anything, then move up to p=reject once your legitimate senders are aligned. Everything happens in your browser. Nothing is sent or stored.
The DMARC Generator turns a few plain choices, such as your policy strength, where reports should go, and how strict alignment must be, into a syntactically correct v=DMARC1 record you can paste straight into DNS. It saves you memorising tag order and spelling, which is where most hand-written records go wrong.
What the tags mean
Every record begins with v=DMARC1 followed by a policy tag. p=none monitors only, p=quarantine diverts failing mail to spam, and p=reject blocks it. The rua tag is the mailbox for aggregate reports; ruf is for forensic failure reports, which fewer receivers send and which can carry message content. The sp tag overrides the policy for subdomains, while adkim and aspf set DKIM and SPF alignment to relaxed (r) or strict (s).
Publishing and rolling out
Publish the generated string as a DNS TXT record at the host _dmarc.yourdomain.com. Keep only one DMARC record per domain, because duplicates void the policy. We recommend this sequence:
- Start at
p=nonewith a workingruaso you collect data without affecting delivery. - Read the reports until every legitimate source passes SPF or DKIM alignment.
- Move to
p=quarantine, optionally usingpctto ramp gradually. - Finish at
p=rejectfor full protection.
Relaxed alignment (r) is the sensible default for most senders; strict only suits tightly controlled domains. If managing this ramp by hand feels risky, DMARC Engine can drive it to enforcement for you; see the enforcement guide or check the requirements first.
Frequently asked questions
Which policy should I generate first?
Start with p=none. It changes nothing about delivery but lets aggregate reports flow to your rua address so you can confirm your real senders pass before you enforce. Tighten to quarantine, then reject, once the data is clean.
What is the difference between rua and ruf?
rua receives aggregate reports, the daily XML summaries of pass and fail counts per source. ruf receives forensic reports about individual failing messages and may include headers or content. Most senders set only rua, as few receivers send forensic data.
Should alignment be relaxed or strict?
Relaxed (adkim=r, aspf=r) is the default and allows subdomains to align with the organisational domain. Strict (s) requires an exact domain match and can break legitimate mail from subdomains or some providers, so use it only when you are certain.
Do I need the pct tag?
It is optional. pct applies your policy to only that percentage of failing mail, which is useful for a gradual move to quarantine or reject. Omitting it means the policy applies to all mail (the default of 100).
Can I point rua at a different domain?
Yes, but that external domain must publish an authorisation record. To receive reports for example.com at third-party.net, the host example.com._report._dmarc.third-party.net must contain v=DMARC1, or receivers will refuse to send the reports.
How long can the generated record be?
DMARC records are short, so length is rarely an issue. Just publish the value as a single TXT record at _dmarc, ensure no second DMARC record exists, and avoid trailing semicolons or stray spaces that some DNS panels add.