DMARC record generator
Build a valid v=DMARC1 TXT record without memorizing the tag syntax. Choose your policy, reporting addresses and alignment. Get copy-paste output and plain-language warnings before you publish.
v=DMARC1; p=none
How to publish it
Add a TXT record to your DNS with the host _dmarc.yourdomain.com and the value above. Start at p=none to monitor, read your reports with the DMARC report reader, then tighten to quarantine and reject once your mail is passing.Frequently asked questions
Where do I publish the DMARC record?
As a TXT record on the host _dmarc.yourdomain.com, for example _dmarc.acme.com. The value is the v=DMARC1 string this tool generates. Add it in your DNS provider (Cloudflare, Route 53, your registrar), wait for it to propagate, then send a test message.
What policy should I start with?
Start with p=none. It changes nothing about delivery but turns on aggregate reporting, so you can see every source sending mail as your domain. Once your legitimate sources are authenticating cleanly, move to p=quarantine, then p=reject. Jumping straight to reject risks blocking your own mail.
What is the rua address for?
rua= is where mailbox providers send daily aggregate (RUA) reports. Without it, DMARC runs silently and you learn nothing. Use a mailbox you'll actually monitor, or a dedicated address you can feed into a report reader. It's the single most important tag after the policy.
Relaxed or strict alignment?
Relaxed (the default) lets subdomains like mail.acme.com align with acme.com, which is what most senders want. Strict requires an exact domain match. Unless you have a specific reason, leave adkim and aspf on relaxed.
What does pct do?
pct= applies your policy to only a percentage of failing mail; the rest is treated as p=none. It's a rollout lever: some admins ramp enforcement with pct=25, then 50, then 100. For full protection, keep it at 100.