Free DMARC Generator
Choose a policy and a report address to build a DMARC record you can paste straight into your DNS, with a plain warning for anything that would leave your domain open.
Building your record...
Could not build the record
Some DNS panels add your domain automatically. If yours does, enter only _dmarc.
Nothing to flag. This record enforces a policy and sends you reports.
What a DMARC Generator Does
A DMARC generator turns a handful of decisions into the exact line of text a DNS zone expects: which policy receivers should apply, who gets the reports, and how strictly the From domain must align with SPF and DKIM. You publish the output as one TXT record at _dmarc.yourdomain.com.
One mistyped tag is enough for receivers to ignore a record, and a record that parses can still protect nothing. This generator leaves out every tag that is already at its default, so the record stays short, and it tells you which choices leave a gap. Once it is live, confirm what receivers see with the DMARC checker.
- Enter your domain so the host comes out complete. You can leave it blank if your DNS panel adds the domain for you.
- Pick a policy. Start at none if you have never read a DMARC report for this domain.
- Add an address for aggregate reports, and change the other tags only if you have a reason to.
- Generate, then copy the host and the record into a new TXT record at your DNS provider.
What the generator gets right for you
- The syntax: v=DMARC1 comes first, p comes second, and tags are separated the way the standard expects.
- The host: the record belongs at _dmarc under your domain, not on the apex with your SPF record.
- The gaps: a policy that does nothing, a missing report address and an open subdomain policy are each called out before you publish.
DMARC Tags the Generator Sets
Only v and p are required. Everything else is optional, and most records need just one more tag: rua.
| Tag | Sets | What to choose | Default |
|---|---|---|---|
| p | The policy | What receivers do with mail that fails: none, quarantine or reject. Required. Move through them in that order. | Required |
| sp | The subdomain policy | The same choice, for subdomains only. Leave it out and subdomains follow p, which is what most domains want. | Same as p |
| pct | The share of failing mail | Applies the policy to a percentage of failing mail during a rollout. The generator omits it at 100. | 100 |
| rua | The report address | Where aggregate reports go. Use a mailbox you can process, because a busy domain receives many reports every day. | None |
| adkim / aspf | Alignment strictness | Relaxed accepts a subdomain of the From domain; strict needs an exact match. Relaxed suits almost every sender. | Relaxed |
How to Use the Output
You get two values to copy and a list of anything worth a second look.
Before you publish
The warningsEach choice that leaves a gap gets one sentence. A warning does not make the record invalid: p=none is flagged on purpose, and it is still the correct first step.
The TXT record
The valuePaste this into the value field exactly as shown. Tags left at their default are omitted, so a short record is expected.
The host
The nameWhere the record lives. If your DNS panel appends the domain to each name, enter only _dmarc, or you will publish at _dmarc.example.com.example.com.
Publishing it
The last stepReplace any existing record at _dmarc rather than adding a second one, wait for the TTL to pass, then read the live record back with the checker.
Which Policy Should You Generate?
If this domain sends mail and you have never read its reports, generate p=none with an rua address. Nothing about delivery changes, and within a few days the reports show every service sending as you.
If the domain sends no mail at all, skip the rollout and generate p=reject. There are no legitimate senders to break, and it stops the name being used in phishing. Pair it with an SPF record that allows nothing, which the SPF record generator can build.
Publishing Your Record
Every DNS provider has the same three fields, under slightly different names.
At your DNS provider:
- Create a record of type TXT, or edit the one already at _dmarc.
- Put the host from this page in the name field.
- Paste the record into the value field, and keep the TTL your provider suggests.
- Once it has propagated, read it back and regenerate when you are ready for the next policy.
Mistakes a Generated Record Will Not Save You From
The syntax will be right. These are the things only you can check:
- Adding this record beside an old one. Two records at _dmarc means receivers apply neither, so remove or replace what is there first.
- Jumping straight to reject on a domain that sends mail. Any service not yet passing SPF or DKIM alignment will have its mail refused, and newsletters and invoicing tools are the usual casualties.
- Sending reports to another domain without authorising it. That domain must publish a TXT record allowing yours, and most report services do this for you only after you add the domain in their dashboard.
- Sending reports to a personal inbox. Aggregate reports arrive as compressed XML, often dozens a day, so use a dedicated mailbox or a report service.
Why Generate Instead of Writing It by Hand
A typo fails silently
A misspelled policy value gives receivers nothing to apply, and neither your DNS panel nor your mail will tell you.
Mailbox providers ask for it
Major mailbox providers require bulk senders to publish DMARC, so a missing record costs you inbox placement.
Reports need a working address
A malformed rua means no reports, and without reports there is no safe way to move past p=none.
Each stage is one edit
Regenerate with the next policy when the reports are clean, and paste it over the old value. The rest of the record stays the same.
Who Generates DMARC Records
The record is short. What differs is how many domains it has to go on.
IT & Email Admins
Build the first record for a domain, then each tighter policy as the rollout moves on.
For DNS monitoringSecurity Teams
Produce a p=reject record for every parked domain, so none of them can be used for phishing.
For IT & MSPsEmail Marketers
Meet the mailbox providers' DMARC requirement before a sending domain goes live.
For marketersAgencies
Hand a client the exact host and value to paste, even when you have no access to their DNS.
For agenciesWhat to Do After Generating
DMARC only passes when SPF or DKIM passes and aligns. These cover the rest.
Check the live record
Read the published record back and see the policy receivers will apply.
DMARC checkerBuild your SPF record
List the services allowed to send as you, in one valid record.
SPF record generatorTest the whole setup
Read MX, SPF, DKIM and DMARC together before you tighten the policy.
Email deliverability checkerKeep it enforced
Get alerted when the policy weakens or a second record appears.
Email auth monitoringFrequently Asked Questions
Common questions about generating and publishing a DMARC record.
How do I generate a DMARC record?
Pick a policy above, add an address for aggregate reports and press generate. You get a host and a TXT value. Create a TXT record with those two values at your DNS provider, and the record is live once its TTL passes.
What should my first DMARC record look like?
For a domain that sends mail, v=DMARC1; p=none; rua=mailto:[email protected] is the standard start. It changes nothing about delivery and begins collecting reports on who sends as you.
Where do I put the DMARC record?
In a TXT record at _dmarc under your domain, such as _dmarc.example.com. It does not go on the apex with SPF. Many DNS panels add the domain themselves, so enter only _dmarc in the name field if yours does.
Can I have more than one DMARC record?
No. When a receiver finds more than one record at _dmarc it applies no policy at all, so the domain is unprotected. Edit the existing record instead of adding a new one.
How long should I stay on p=none?
Until the reports show every legitimate sender passing SPF or DKIM with alignment. For a simple setup that can be two to four weeks; a domain with many sending services can take longer.
Do I need an rua address?
The record is valid without one, but you lose the reason to run p=none. Aggregate reports are how you find every service sending as your domain before you enforce a policy.
Should I set a ruf address?
Usually not. Failure reports can contain message details and many providers no longer send them. rua is the address that matters; ruf is optional.
Should I use strict alignment?
Most domains should stay on relaxed, which allows mail from a subdomain to align with the main domain. Strict needs an exact match and tends to break legitimate mail from services that send from a subdomain.
Is a DMARC generator enough on its own?
No. The record states a policy, and SPF and DKIM decide whether mail passes it. Check both are working for every sender before moving to quarantine or reject.
Start Monitoring & Catching Domains Today
Join founders, agencies, and domainers already protecting their portfolio. Your first 5 domains are free.
No credit card required • Cancel anytime
Guides for domain operators
Deep dives on domain names, DNS, SSL, acquisitions and portfolio management.
All guides →
4 Letter Domains: The Complete LLLL Investing Playbook
4 letter domain names represent one of the most liquid segments of the domain aftermarket. All 456,976 possible .com combinations are registered.
.SI Domain: Slovenia's 30-Year-Old ccTLD Is Suddenly Super Intelligence
What is the .SI domain? Learn how Slovenia's country-code TLD went from 10 registrations in 1992 to a 2,199% surge in September 2026, and why 'super intelligence' made .SI the new .AI.
Infringing Domains: Detecting, Monitoring, and Recovering
Your domain is your storefront. Every day, someone registers a lookalike of it, to skim your traffic, phish your customers, or hold it for ransom. This guide covers what infringing domains are, how to find them before they hurt you, and exactly what to do when you do.