Web Tools
DMARC Record Generator
Build a DMARC TXT record for domain email protection.
Domain and rollout
Monitor only: receivers send reports but do not apply a DMARC enforcement action.
Reports and alignment
Generated DNS TXT record
Add this as a TXT record at the host shown below.
_dmarc.example.comv=DMARC1; p=none; rua=mailto:dmarc-reports@example.com; fo=1; ri=86400The record shape looks valid. Publish it as TXT, then use your mail provider reports to confirm real-world alignment.
Tag breakdown
| Tag | Meaning | Value |
|---|---|---|
| v | Version | DMARC1 |
| p | Domain policy | none |
| rua | Aggregate reports | mailto:dmarc-reports@example.com |
| fo | Failure options | 1 |
| ri | Report interval | 86400 |
About This Tool
DMARC helps domain owners tell receiving mail servers what to do when email fails SPF or DKIM alignment. This generator builds a DNS TXT value for the _dmarc host of your domain, explains the tags, and highlights rollout risks before you publish the record in Cloudflare, a registrar, or another DNS provider. It is designed for careful setup: start with monitoring, review aggregate reports, then move toward quarantine or reject when legitimate mail is aligned.
How To Use It
- Enter the root domain you want to protect, such as example.com.
- Choose a DMARC policy. Use none for monitoring, quarantine for partial enforcement, or reject for strict enforcement.
- Add an aggregate report email if you want receivers to send DMARC XML reports.
- Adjust percentage, subdomain policy, alignment, failure options, and report interval only when you understand what your mail provider expects.
- Copy the host and TXT value into your DNS provider, then monitor reports and delivery before increasing enforcement.
Examples
Start with monitoring
Use p=none and a rua report address to collect DMARC reports without asking receivers to quarantine or reject mail.
Gradual quarantine rollout
Use p=quarantine with pct=25 to ask receivers to quarantine only part of failing mail while you watch reports.
Strict protection
Use p=reject only after SPF, DKIM, and legitimate sending services are aligned for your domain.
Useful Notes
What DMARC protects
DMARC reduces spoofing by connecting SPF or DKIM authentication to the visible From domain. If a message fails alignment, the DMARC policy tells receivers whether the domain owner prefers monitoring, quarantine, or rejection.
Recommended rollout
Most domains should begin with p=none and aggregate reports. After reviewing reports and fixing legitimate senders, move to quarantine with a small percentage, then increase enforcement toward reject when mail flow is clean.
Reports and privacy
Aggregate rua reports help you see who is sending mail for the domain. Forensic ruf reports are less widely supported and may contain sensitive message details, so enable them carefully.
DNS provider details
Publish the output as a TXT record at _dmarc.yourdomain.com. Some dashboards ask only for the host part _dmarc, while others ask for the full hostname. Do not publish it as a CNAME or MX record.
Limitations
This tool generates and validates the record shape locally. It does not perform live DNS lookups, confirm SPF or DKIM alignment, parse XML reports, or guarantee that every receiver will follow the requested policy.
FAQ
Should I start with p=reject?
Usually no. Start with p=none, collect aggregate reports, fix legitimate senders, then move gradually to quarantine or reject.
Where do I add the DMARC record?
Add it as a DNS TXT record at _dmarc for the root domain, for example _dmarc.example.com.
Do I need SPF and DKIM first?
Yes. DMARC depends on SPF or DKIM alignment. A strict DMARC policy can block legitimate mail if those records are missing or misconfigured.
Does this send my domain or report email anywhere?
No. The generator runs in your browser and does not send the entered values to a server.
Related Tools
DNS Record Validator
Check DNS record values before adding them to a provider.
HTTP Status Code Lookup
Find HTTP status meanings and next steps.
Meta Tag Previewer
Preview search and social snippets from page metadata.
Robots.txt Tester
Check robots.txt rules for a crawler and path.