Skip to content
Emergency helpGet started
Back to Tools

DMARC Record Generator

Create a DMARC record for your domain. Choose a policy, add report addresses and optional tags, and copy a TXT record for _dmarc that follows RFC 7489 and the changes in RFC 9989.
Build a record
  • Runs in your browser
  • No DNS lookups
Generator

Build your DMARC record

Choose a policy and where reports go. The record updates as you type.

Names the _dmarc host and checks whether reports go to another domain.

Policy for mail that fails DMARC (p)

One email address per line. Receivers send summary reports of mail using your domain here.

More options

Added by RFC 9989.

Leave it empty for the default of 100. RFC 9989 made pct historic.

DKIM alignment (adkim)
SPF alignment (aspf)

Optional. Failure reports describe individual messages and can contain personal data.

Failure reporting options (fo)

Receivers use these only when ruf is set.

Your record

Host
_dmarc
Type
TXT
Value
v=DMARC1; p=none

Checks

Warning

Without rua, receivers send no aggregate reports, so you cannot see who sends mail as your domain before you enforce a policy.

Warning

p=none is monitoring only: receivers take no action on mail that fails DMARC. Move to quarantine once your reports show every legitimate sender passing.

Check the published record with the DMARC checker

What is a DMARC record generator?

A DMARC record generator writes the TXT record you publish at _dmarc followed by your domain. Pick a policy for mail that fails DMARC and add the addresses that should receive reports; the generator puts v=DMARC1 first and p second, as RFC 7489 requires, and leaves out tags that only repeat a default.

It follows RFC 7489 and the changes in RFC 9989, which obsoleted it in May 2026: np and t are available and pct is marked historic. It builds the record in your browser and makes no DNS lookups.

A safe DMARC rollout

  1. 1

    Start with p=none and rua

    Collect aggregate reports and fix SPF and DKIM for every legitimate sender they show.

  2. 2

    Move to p=quarantine

    Receivers treat failing mail as suspicious. Keep reading the reports for problems you missed.

  3. 3

    Move to p=reject when you are ready

    Make sure every sender signs with DKIM first, because forwarding often breaks SPF. RFC 9989 advises domains whose users post to mailing lists not to publish p=reject.

  4. 4

    Check the published record

    Run the DMARC checker once DNS has propagated.

DMARC tags

Tags are separated by semicolons. Tags a receiver does not know are ignored.
v=DMARC1
The version. It must be the first tag.
p=
The policy for mail that fails DMARC: none, quarantine or reject.
sp=
The policy for subdomains. Without it, subdomains follow p.
rua=
Where aggregate reports go, as mailto: addresses separated by commas.
ruf=
Where failure reports about individual messages go. Many large mailbox providers do not send them.
adkim= / aspf=
DKIM and SPF alignment: r (relaxed, the default) accepts a subdomain of the From domain, s (strict) needs an exact match.
fo=
Which failures trigger failure reports: 0, 1, d or s. Ignored without ruf.
pct=
The percentage of failing mail the policy applies to, 100 by default. RFC 9989 made it historic.
np= / t=
Added by RFC 9989: a policy for subdomains that do not exist, and t=y to test a policy without applying it in full.

Example record

v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@example.com

Sources

More email authentication tools

Beyond DNS records

These records stop other people sending mail as your exact domain. They do not stop phishing from lookalike domains or from compromised accounts, which send authenticated mail. Vigilbase OS connects the security tools you already pay for, including Microsoft 365, Google Workspace, Proofpoint and Mimecast. The Vigil agent investigates high-severity incidents and Vigilbase analysts handle exceptions.

Managed SOCGet started
Questions

DMARC record generator FAQ

How do I create a DMARC record?

Choose a policy, starting with p=none, add a rua address for aggregate reports, and publish the result as a TXT record at _dmarc followed by your domain. This generator writes the tags in the right order and checks the record as you type.Email Security AnalyzerCompare the public security checks

What should my first DMARC policy be?

p=none with a rua address, so you get reports without affecting delivery. Move to p=quarantine once the reports show every legitimate sender passing SPF or DKIM with alignment.For domains whose users post to mailing lists, RFC 9989 suggests at least a month at p=none and as long again at p=quarantine before p=reject (section 7.4).About email authentication

Do I need a ruf address?

No. ruf requests failure reports about individual messages. They can contain personal data, many large mailbox providers do not send them, and RFC 9991 recommends aggregate reports for visibility instead (section 7).About email authentication

Can DMARC reports go to another domain?

Yes, but unless the report address shares your organizational domain, the receiving domain must publish a TXT record containing v=DMARC1 at your domain, then _report._dmarc, then its own domain, for example example.com._report._dmarc.example.net. Without it, receivers cannot confirm the arrangement and do not send reports there (RFC 7489, section 7.1; RFC 9990, section 4).About email authentication

Should I still use pct?

RFC 9989 made pct historic because receivers applied values other than 0 and 100 inconsistently, and replaced pct=0 with t=y. Receivers that only implement RFC 7489 ignore t, because unknown tags are ignored.About email authentication

Does the generator look anything up?

No. It builds the record in your browser from what you enter and makes no DNS lookups. Use the DMARC checker to see the record that is published.Email Security Analyzer