DMARC
DMARC Record Generator
Answer five plain-English questions. We give you the exact TXT record to add to DNS. Start with p=none and step up safely as your aggregate reports come in clean.
New to DMARC? Read What is DMARC in the Email Almanac.
The bare domain in your From address. If you send from hello@yourcompany.com, enter yourcompany.com.
How it works
How this generator builds your record
The output is plain DNS, nothing more. We never touch your zone; you copy the value and paste it where you publish DNS.
Step 1
Pick the domain in your From address. The DMARC record is published at the special host _dmarc.{your domain}.
Step 2
Pick the enforcement policy. Most domains should start at p=none to collect reports before they enforce anything.
Step 3
Add a reporting mailbox. Daily aggregate reports tell you who is sending mail as you and whether they pass authentication.
Step 4 + 5
Decide subdomain handling and alignment mode. Most senders keep subdomains on the same policy and use relaxed alignment.
When to use it
When this tool fits
The generator is for the publish step, not the strategy. The right policy depends on what your reports say.
- You just got the Google or Yahoo bulk-sender notice. You need a DMARC record fast and you want one that does not break your mail. Generate at p=none, publish, watch reports for two weeks, then come back and rebuild at p=quarantine.
- You inherited a domain with no DMARC. Publish p=none with an aggregate report address. Find every shadow IT sender by reading the reports.
- You are tightening a domain that is already at p=none. The reports show every sender passes. Generate at p=quarantine, give it a week, then move to p=reject.
Go deeper
Related Email Almanac questions
The Almanac covers the why behind the policy choices this tool makes you pick from.
Want a full deliverability audit?
DMARC is one signal. We read every signal that affects whether your mail lands in the inbox and write you a plain-English report.
Try it deeper with RME