Skip to main content

Web Tools

DMARC Record Generator

Build a DMARC TXT record for domain email protection.

DMARC Record Generator tool

Loading tool…

Jump to a section

About This Tool

DMARC helps domain owners tell receiving mail servers what to do when email fails SPF or DKIM alignment. This generator builds a DNS TXT value for the _dmarc host of your domain, explains the tags, and highlights rollout risks before you publish the record in Cloudflare, a registrar, or another DNS provider. It is designed for careful setup: start with monitoring, review aggregate reports, then move toward quarantine or reject when legitimate mail is aligned.

How To Use It

  1. Enter the root domain you want to protect, such as example.com.
  2. Choose a DMARC policy. Use none for monitoring, quarantine for partial enforcement, or reject for strict enforcement.
  3. Add an aggregate report email if you want receivers to send DMARC XML reports.
  4. Adjust subdomain policy, alignment, and failure-report options only when you understand what your mail provider expects.
  5. Copy the host and TXT value into your DNS provider, then monitor reports and delivery before increasing enforcement.

Examples

Start with monitoring

Use p=none and a rua report address to collect DMARC reports without asking receivers to quarantine or reject mail.

Gradual quarantine rollout

Move from p=none to p=quarantine after reviewing reports and fixing legitimate senders, then continue monitoring before moving to reject.

Strict protection

Use p=reject only after SPF, DKIM, and legitimate sending services are aligned for your domain.

Useful Notes

What DMARC protects

DMARC reduces spoofing by connecting SPF or DKIM authentication to the visible From domain. If a message fails alignment, the DMARC policy tells receivers whether the domain owner prefers monitoring, quarantine, or rejection.

Recommended rollout

Most domains should begin with p=none and aggregate reports. After reviewing reports and fixing legitimate senders, move to quarantine, then move to reject when mail flow is clean. The current DMARC standard no longer includes the legacy pct sampling tag.

Reports and privacy

Aggregate rua reports help you see who is sending mail for the domain. Forensic ruf reports are less widely supported and may contain sensitive message details, so enable them carefully. Failure options in fo only apply when ruf is present; 0 and 1 are mutually exclusive.

DNS provider details

Publish the output as a TXT record at _dmarc.yourdomain.com. Some dashboards ask only for the host part _dmarc, while others ask for the full hostname. Do not publish it as a CNAME or MX record.

Limitations

This tool generates and validates the record shape locally. It does not perform live DNS lookups, confirm SPF or DKIM alignment, parse XML reports, or guarantee that every receiver will follow the requested policy.

FAQ

Should I start with p=reject?

Usually no. Start with p=none, collect aggregate reports, fix legitimate senders, then move gradually to quarantine or reject.

Where do I add the DMARC record?

Add it as a DNS TXT record at _dmarc for the root domain, for example _dmarc.example.com.

Do I need SPF and DKIM first?

Yes. DMARC depends on SPF or DKIM alignment. A strict DMARC policy can block legitimate mail if those records are missing or misconfigured.

Does this send my domain or report email anywhere?

No. The generator runs in your browser and does not send the entered values to a server.