DMARC record generator
Build a correct DMARC record in a minute. Pick where the domain is in its journey, and we'll suggest safe settings and explain each one.
Your record
v=DMARC1; p=none- No report address, so nobody will see who sends email as this domain. Add one before moving past p=none.
Built in your browser; nothing is sent to us. Once it's published, check it with the DMARC checker.
What each part of the record does
- v=DMARC1
- Marks the record as DMARC. It must come first.
- p=
- What receivers do with email that fails: none (deliver and report), quarantine (spam) or reject (refuse).
- sp=
- The same for subdomains. Left out, subdomains follow p.
- pct=
- The share of failing email the policy applies to. Left out, it's 100. Lower values are for tightening in steps.
- rua=
- Where receivers send daily aggregate reports: who sent email as the domain, and whether it passed.
- adkim=, aspf=
- Alignment. Relaxed (r, the default) lets a subdomain match; strict (s) needs the exact domain.
A safe path for most domains: start at p=none with a report address, read the reports until every real sender passes SPF or DKIM, then move to p=quarantine and finally p=reject. The guide What is DMARC? A plain-English guide walks through each step.
Publish the record as a TXT record named _dmarc in the domain's DNS. There must be only one. Then run the DMARC checker to confirm receivers can see it.
Do this for every client, every day
- All nine checks on every client domain, daily, graded A to F
- Alerts by email or webhook when a grade drops or a record changes
- A monthly report card for each client, with your logo on it
- Hosted DMARC, SPF, DKIM and MTA-STS, so fixes don't wait for a DNS login
Start a free 28-day trial: up to 3 domains, no card needed.
Keep going
- What is DMARC? A plain-English guideThe guide
- DMARC checkerSee a domain's DMARC policy in plain English, and where its reports go.
- SPF checkerCount an SPF record's DNS lookups against the limit of 10, include by include.
- DKIM checkerFind a domain's DKIM keys, with or without the selector, and check their size.
- Free domain checkerAll nine checks on a domain, with a grade from A to F.
- Report cardsWhat your clients get each month, with your logo on it.
Questions
Which policy should I start with?
p=none with a report address, so you can see every service sending as the domain. Once they all pass SPF or DKIM, move to quarantine, then reject.
What should a domain that never sends email use?
p=reject, with "v=spf1 -all" as its SPF record and a null MX record if it receives no email either. Choose "Never sends email" above to get all three.
Why is there no ruf (forensic report) option?
Forensic reports can contain personal data from individual emails, and most large providers don't send them. Aggregate reports (rua) are what you need.
Do you keep what I type?
No. The record is built in your browser and nothing is sent to us.
How do I check it once it's published?
Run the DMARC checker on the domain. DNS changes usually show within minutes, but can take up to the record's TTL.
Let us host DMARC for every client.
Start a free 28-day trial: up to 3 domains, no card needed.