DMARC Record Generator
Runs in your browser — your data is never uploaded.
Build the DMARC record that tells receiving servers what to do with mail claiming to be from you that fails authentication. Two things sink most first attempts: publishing it at the domain instead of _dmarc.yourdomain, where it looks right and does nothing; and jumping straight to p=reject, which starts silently dropping the legitimate senders you had forgotten about. The output covers both.
How to use DMARC Record Generator
- 1
Start with policy “none” and add an address to receive the aggregate reports.
- 2
Click “Generate” and publish it as a TXT record named _dmarc.yourdomain.com.
- 3
Read a few weeks of reports, fix what fails, then come back and tighten the policy.
Share
Embed this tool on your site
Paste this where you want the tool to appear. It runs entirely in your visitor's browser — no uploads, no account, no tracking.
Please keep the attribution line — it's what keeps these tools free.
Need a different size, a dark theme, or a different tool? Build an embed lets you preview it first.
Frequently asked questions
Where exactly does the record go?+
At the hostname _dmarc.example.com, as a TXT record — not on the domain itself. In most DNS panels the Name field takes just _dmarc and the domain is appended for you. A DMARC record published at the root is ignored completely, and nothing anywhere reports that it is.
Should I start with p=reject?+
No. Start at p=none, which changes nothing about how mail is handled and simply turns on reporting. The reports will show senders you had forgotten — a helpdesk tool, an old CRM, a marketing platform on a subdomain. Fix those first. Going to reject on day one rejects them instead of telling you about them.
What is rua for?+
The mailbox that receives daily aggregate reports: XML summaries of who sent mail as your domain and whether it passed. It is the most useful tag in the record and the reason to publish one at all. A DMARC record without rua enforces a policy while giving you no way to know what it is doing.
What do adkim and aspf do?+
They set how strictly the authenticated domain must match your From: address. Relaxed — the default — accepts a subdomain, which is what most email providers use for their bounce domain. Strict requires an exact match and will fail perfectly legitimate mail from any ESP that does not align exactly. Relaxed is right for almost everyone.
Do I need SPF and DKIM first?+
Yes. DMARC only acts on mail failing both SPF and DKIM alignment — it has nothing to evaluate on its own. Publish SPF, set up DKIM signing with your mail provider, confirm both pass, and only then add DMARC on top.