DMARC Record Generator

About this tool

DMARC tells receiving mail servers what to do with mail that claims to be from your domain but fails SPF and DKIM checks, and where to send reports about it. Start with p=none and an rua address: nothing is blocked, and the daily aggregate reports show every server sending as your domain, so you can fix legitimate senders. Then move to quarantine, optionally with a percentage to phase it in, and finally reject. This tool builds the record in the standard tag order, validates report addresses (including optional size limits such as !10m), leaves out tags that are already at their defaults, and warns about common mistakes: no report address, a percentage that has no effect with p=none, or failure reports (ruf) that few providers send. The record goes in a TXT record named _dmarc at your domain. DMARC needs SPF or DKIM to pass and align with the visible From domain, so set those up first. Records are checked with an independent DMARC parser. Nothing is sent anywhere.

How to use it

1. Start with policy none and your own email address for aggregate reports.
2. Copy the record into a TXT record named _dmarc at your domain.
3. Read the reports for a few weeks and fix any legitimate sender that fails.
4. Raise the policy to quarantine, then reject, using the percentage to phase it in.

Common problems

I set p=reject and my own mail bounced

A legitimate sender fails SPF or DKIM alignment. Go back to p=none, read the reports, fix the sender, and phase in again with pct.

I do not get reports

Check the rua address and that your mailbox accepts large attachments. Reports to another domain need that domain to publish an authorisation record.

Does DMARC replace SPF and DKIM?

No. It builds on them: at least one must pass and align with the From domain.