What this builds
A DMARC record is one TXT record on _dmarc.yourdomain.com. It tells receiving servers what to do with mail that claims to come from your domain but fails SPF and DKIM, and where to send reports about it. Gmail, Yahoo and Outlook require one from anyone who sends in bulk.
This generator writes that record from a short form: the policy, the address for reports and, if you need them, the subdomain policy and strict alignment. Everything is built in your browser. If you type a domain that already has DMARC, the page asks our checker for the current record once, fills the form from it and shows which tags your new value changes.
Monitor first, then quarantine, then reject
- Monitor (
p=none). Mail is delivered exactly as before, and receivers send you daily reports. Publish this first and read the reports for two to four weeks: every service that sends as your domain shows up. - Fix what fails. A service that fails is usually missing from your SPF record or has no DKIM set up. The SPF record generator and the SPF checker help with the SPF half.
- Quarantine (
p=quarantine). Once only mail you do not recognise fails, failing mail goes to spam. Watch the reports again. - Reject (
p=reject). Failing mail is refused. This is full protection from people sending as your domain. Keep the reports coming: they warn you when someone adds a new email tool without telling you.
Going straight to reject without reading reports is how newsletters and invoices disappear: the service that sends them was never set up for your domain.
Where reports go
The rua address gets one aggregate report per receiver per day, as an XML file. A mailbox you read works for a small domain; a DMARC report service turns the files into charts and is easier once you have several senders.
If the address is on another domain, for example a report service, that domain must publish a TXT record saying it accepts reports for yours: yourdomain.com._report._dmarc.reportdomain.com with the value v=DMARC1. Report services do this for you. If you use your own mailbox on another domain, the generator shows the exact record to add.
Subdomains and alignment
Without an sp tag, subdomains follow the same policy as the domain, which is what most domains want. Set a separate subdomain policy only for a reason, for example sp=reject while the domain itself is still at p=none. A subdomain policy weaker than the main one lets anyone send from an invented subdomain, so the generator warns about it.
Alignment is relaxed by default: mail.yourdomain.com counts as your domain. Strict alignment (adkim=s, aspf=s) needs an exact match and breaks many sending services that use a subdomain of yours for bounces. Leave it relaxed unless your reports show every sender aligned exactly.
Tags the form has no field for (pct, ruf, fo, rf, ri) are kept from your current record as they are, and you can remove them one by one.
How to publish it
- Copy the value from the result box.
- Open your DNS provider (Cloudflare, GoDaddy, Namecheap, Route 53, your registrar…) and find the TXT records of your domain.
- Edit the existing DMARC record if there is one, and replace its value. Otherwise add a TXT record with the host
_dmarc(some providers want the full name,_dmarc.yourdomain.com). - Save and wait for DNS to update, usually a few minutes to an hour.
- Check it with the DMARC checker. The "Check after publishing" button opens it with your domain filled in.