DMARC record generator
Build a DMARC record for your domain in a few seconds. Enter your domain and an email address for reports, pick a policy, then copy the record into your DNS.
The domain in your email address, after the @. You can paste an email or web address and we'll use just the domain.
Daily summary reports (XML files) from Gmail, Microsoft, Yahoo and others. A separate mailbox or a DMARC reporting service is best. Separate several addresses with commas.
More options
Relaxed alignment lets a subdomain match, so email from news.example.co.uk counts for example.co.uk. Most receivers send aggregate reports once a day whatever interval you ask for.
Copies of individual failing emails. Most big providers, including Gmail and Microsoft, don't send them, and the ones that arrive can contain personal data such as names and email addresses, so only add this if you'll handle them carefully.
Your DMARC record
Enter your domain above to see your record.
Everything runs in your browser. Nothing you type is stored or sent anywhere.
Once the record is published, check it with the Email DNS checker, or see all your records with the DNS lookup.
A safe way to roll out DMARC
Going straight to p=reject can block your own email if a service that sends for you (a newsletter tool, a website contact form, an accounts system) isn't set up properly. Step up gradually instead:
- Start at
p=nonewith a report address. Nothing changes for delivery, but you start getting daily reports showing every server sending email as your domain. - Read the reports for two to four weeks. Look for your own services failing SPF or DKIM, and fix them: add them to your SPF record, or turn on DKIM signing in each one. A free DMARC reporting service makes the XML much easier to read.
- Move to
p=quarantine. If you're nervous, usepct=25first so only a quarter of failing email goes to spam, then raise it to 100. - Move to
p=reject. Once quarantine has run for a few weeks with no genuine email failing, reject spoofed email outright. Keep reading the reports now and then, especially when you add a new email service.
Where to add the record
Add a new TXT record wherever your domain's DNS is managed. That's usually where you bought the domain, unless you've moved the nameservers to a service such as Cloudflare. The DNS lookup shows your nameservers if you're not sure.
- The name or host field. Most panels add your domain automatically, so you type just
_dmarc. If you type the full_dmarc.example.co.ukas well, you can end up with_dmarc.example.co.uk.example.co.uk. Some panels (and zone files) want the full name, often with a dot at the end. If in doubt, enter_dmarc, save, and check the result with the Email DNS checker. - Cloudflare: open the domain, go to DNS, Records, choose Add record, set Type to TXT, Name to
_dmarc, paste the value into Content and save. Cloudflare also offers its own DMARC Management with free reports. - Microsoft 365: if Microsoft manages your DNS, go to the Microsoft 365 admin centre, Settings, Domains, pick your domain, then DNS records, Add record, and choose TXT with
_dmarcas the TXT name. If your domain's DNS is elsewhere (most are), add it at your DNS provider instead. - GoDaddy, IONOS, Fasthosts, 123 Reg and similar: find the domain's DNS or DNS management page, add a record, choose TXT, enter
_dmarcin the Host or Name box and paste the value. Leave TTL on the default, or one hour. - Only one DMARC record. If there's already a TXT record at
_dmarc, edit it rather than adding a second, because two DMARC records cancel each other out.
How this tool works
A DMARC record is a single line of text published in DNS as a TXT record at _dmarc.yourdomain. It's a list of tags separated by semicolons, starting with v=DMARC1. This tool builds that line from your choices as you type, and checks it for common mistakes:
pis the policy for your domain:none,quarantineorreject.spsets a different policy for subdomains.rualists where aggregate reports go, asmailto:addresses.rufdoes the same for failure reports, andfosays when those are sent.pctapplies the policy to only part of failing email.adkimandaspfset whether the SPF and DKIM domains must match your From domain exactly (strict) or can be a subdomain of it (relaxed).riasks for a report interval in seconds.
Tags left at their default value are missed out, which keeps the record short and easier to read. Report addresses on a different domain need that domain's permission, published as its own TXT record, so the tool shows that record too.
Tips
- Get SPF and DKIM right first. DMARC only passes when SPF or DKIM passes for your own domain, so check both with the Email DNS checker before tightening the policy.
- Use a dedicated report address. Reports arrive daily from every large mail provider, so a busy domain can get dozens. A separate mailbox, or a reporting service that turns them into charts, saves cluttering your inbox.
- Protect domains that never send email. Publish
v=DMARC1; p=rejecton them straight away, along with an SPF record ofv=spf1 -all, so nobody can send email pretending to be them. - Bulk senders need DMARC. Gmail and Yahoo require a DMARC record (at least
p=none) from anyone sending large volumes of email to their users.
Frequently asked questions
What is a DMARC record?
It's a TXT record in your domain's DNS that tells receiving mail servers what to do with email that claims to come from your domain but fails SPF and DKIM checks, and where to send reports about it. It helps stop people sending spoofed or phishing email using your domain.
Which policy should I choose?
Start with p=none so you can see who sends email as your domain without affecting delivery. Move to quarantine and then reject once the reports show all your genuine email passing. Only quarantine and reject actually protect your domain.
Do I need a report address?
It's optional, but without rua nobody sends you reports, so you can't tell whether your own email passes or who is spoofing you. That makes moving beyond p=none guesswork.
Why does a report address on another domain need an extra record?
To stop people flooding someone else's mailbox with reports, receivers check that the other domain agrees to take them. It does that by publishing a TXT record named yourdomain._report._dmarc.theirdomain containing v=DMARC1. Reporting services usually set this up for you; if the address is on another domain you own, add it yourself.
Does pct still work?
Most receivers still read it, but not all apply it exactly, and the updated DMARC standard replaces it with a simpler testing flag. Treat pct as a gentle step between none and a full policy rather than a precise dial.
Do subdomains need their own DMARC record?
No. If a subdomain has no record of its own, receivers use the main domain's record and its sp policy (or p if there's no sp). Add a separate record only if a subdomain needs different settings.
How long until the record works?
Usually within an hour, but DNS changes can take up to a day to reach everywhere. The first aggregate reports normally arrive a day or two after the record is visible.
Do you store what I type?
No. The record is built by JavaScript in your browser. Nothing is sent to our server or anyone else, and nothing is kept.