Free tool · No account needed
DMARC Record Generator
DMARC tells receivers what to do with mail that claims to be from your domain but fails SPF and DKIM, and where to send reports about it. Choose a policy and a report address, and copy the record to publish.
Your DMARC record
- Type
- TXT
- Name
- _dmarc
Value
v=DMARC1; p=none- Without a report address you get no information on who sends mail as the domain — what you need to tighten the policy safely.
- p=none changes nothing about how mail is handled; it only collects reports. Start here, and move to quarantine and then reject once the reports show your real senders passing.
About DMARC
What the record does
- It is what actually protects the From address people see. SPF and DKIM prove where a message came from; DMARC says what happens when they do not match it.
- Large mailbox providers now expect a DMARC record from anyone sending in bulk, and junk or reject mail from domains without one.
- Tighten in steps. Moving straight to reject can lose mail from a newsletter tool or a CRM you forgot sends as you.
Free tools
More free tools
- DNS LookupCheck any record type on three public resolvers and the domain's own nameserver, and see whether a change has propagated.
- SPF Record GeneratorBuild the SPF record that authorises your email providers to send as your domain, with the lookup limit checked as you go.
- Favicon GeneratorTurn an image or a letter into favicon.ico, the PNGs every platform asks for and a web manifest — made in your browser.
Questions
Frequently asked questions
- Which policy should I start with?
- p=none with a report address. It changes nothing about delivery, and the reports show every service sending as your domain. Once your real senders pass, move to quarantine, then reject.
- Where do I publish it?
- As a TXT record at _dmarc under your domain — _dmarc.example.com. At most DNS providers you enter just _dmarc as the name.
- What do the reports contain?
- Daily aggregate reports (rua) list which servers sent mail as your domain and whether each passed SPF and DKIM. They are XML; a DMARC report service turns them into something readable.
- What does alignment mean?
- DMARC passes only when the domain that SPF or DKIM checked matches the From address. Relaxed lets a subdomain such as mail.example.com match example.com; strict needs the exact domain. Relaxed suits almost everyone.