DMARC Generator
Build a valid DMARC record from a simple form.
Build a valid DMARC record for your domain, then copy and paste it into your DNS. Start at p=none to watch your mail without blocking anything, then move up to p=reject once your legitimate senders are aligned. Everything happens in your browser. Nothing is sent or stored.
The DMARC Generator creates a current RFC 9989 v=DMARC1 policy record from plain choices.
What the tags mean
p sets the Author Domain policy; sp covers subdomains and np can cover non-existent subdomains. t=y is the current test mechanism and asks receivers to apply one policy level lower. rua requests aggregate reports; ruf requests privacy-sensitive failure reports that many receivers do not send. adkim and aspf control alignment.
Publishing and rolling out
Publish one TXT policy at _dmarc.yourdomain.com. Start with p=none, identify and align every legitimate service from aggregate reports, test quarantine with p=quarantine; t=y, then enforce quarantine. Repeat that evidence gate with p=reject; t=y before full reject. Legacy pct, rf and ri are recognized when inspecting old records but are not generated as current configuration.
Frequently asked questions
Which policy should I generate first?
Start with p=none and a working rua. Do not advance until every legitimate sender is identified and aligned.
What does t=y do?
RFC 9989 test mode applies one policy level lower: reject is tested as quarantine, and quarantine is tested as none.
Can I point rua at a different domain?
Yes, but that external destination must publish the required DMARC report-receiver authorization.