DMARC Record Generator
Builds the v=DMARC1 TXT record for _dmarc.yourdomain.com from your policy and report addresses, and refuses an address that isn't one. Nothing leaves your browser.
@emailens/engine 0.18.22 · data last changed 10 Nov 2026
Add a mailbox for the daily reports, the reason to publish DMARC.
Advanced: alignment, coverage, forensic options
v=DMARC1; p=noneMonitoring mode, the right first step. Reports come in and nothing is blocked. Tighten to quarantine once they show your mail passing.
How to publish it
Add a TXT record to your DNS with the host _dmarc.yourdomain.com and the value above. Start at p=none to monitor, read your reports with the DMARC report reader, then tighten to quarantine and reject once your mail is passing.Published it? Send yourself a test email, then open the checker and paste it there to see how it renders: five clients, no account.
No signup · Five clients free, Outlook Classic included · All 21 with an account
Which clients need an account
Gmail Android, Gmail iOS, Outlook 365, Outlook iOS, Outlook Android, Outlook for Mac, Apple Mail, Yahoo Mail Android, Yahoo Mail iOS, Samsung Mail, Thunderbird, HEY Mail, Proton Mail, AOL Mail, Fastmail, Superhuman open with a free account.
The checker needs a computer screen.
Your next question
Other free tools: SPF Record Checker · DKIM Checker · DMARC Checker · BIMI Checker · Blocklist Checker · Email Header Analyzer · Email Spam Checker
Run this check on every email
SPF, DKIM and DMARC monitoring (Dev). Dev is $9 a month. Share links for your client's sign-off, a test inbox and an API key. See the plans →
Questions
Where do I publish the DMARC record?
As a TXT record on the host _dmarc.yourdomain.com, for example _dmarc.acme.com. The value is the v=DMARC1 string this tool generates. Add it in your DNS provider (Cloudflare, Route 53, your registrar), wait for it to propagate, then send a test message.
What policy should I start with?
Start with p=none. It changes nothing about delivery but turns on aggregate reporting, so you can see every source sending mail as your domain. Once your legitimate sources are authenticating cleanly, move to p=quarantine, then p=reject. Jumping straight to reject risks blocking your own mail.
What is the rua address for?
rua= is where mailbox providers send daily aggregate (RUA) reports. Without it, DMARC runs silently and you learn nothing. Use a mailbox you'll actually monitor, or a dedicated address you can feed into a report reader. It's the single most important tag after the policy.
Relaxed or strict alignment?
Relaxed (the default) lets subdomains like mail.acme.com align with acme.com, which is what most senders want. Strict requires an exact domain match. Unless you have a specific reason, leave adkim and aspf on relaxed.
What does pct do?
pct= applies your policy to only a percentage of failing mail; the rest is treated as p=none. It's a rollout lever: some admins ramp enforcement with pct=25, then 50, then 100. For full protection, keep it at 100.