Trust beats tactics™

DMARC

DMARC Record Generator

Answer a few plain-English questions. We give you the exact TXT record to add to DNS. Start with p=none and step up safely as your aggregate reports come in clean.

Built to the current DMARC standard, RFC 9989, the 2026 update often called DMARCbis. That means no pct tag, a t tag for a staged rollout, and a separate np tag for subdomains that do not exist.

New to DMARC? Read What is DMARC in the Email Almanac.

Step 1 of 617%

The bare domain in your From address. If you send from hello@yourcompany.com, enter yourcompany.com.

How this tool works

How this generator builds your record

  1. 1

    Pick the domain

    The domain in your From address. The record is published at the special host _dmarc.your-domain. We never touch your zone. You copy the value and paste it where you publish DNS.

  2. 2

    Pick the policy

    Choose to enforce it, or publish in testing mode with t=y. Most domains start at p=none to collect reports before they enforce anything.

  3. 3

    Add a reporting mailbox

    Daily aggregate reports tell you who is sending mail as you and whether they pass authentication.

  4. 4

    Set subdomains and alignment

    Use sp for names that exist and np for names that do not, then pick alignment mode. Most senders keep subdomains covered and use relaxed alignment.

The path most domains take

  1. p=noneWatch reports for two weeks
  2. p=quarantineGive it a week
  3. p=reject

The output is plain DNS, nothing more. The right policy depends on what your reports say.

When to use it

Reach for it in these moments

  • You got the Google or Yahoo bulk-sender notice

    You need a record fast that does not break your mail. Generate at p=none, publish, watch reports for two weeks, then come back and rebuild at p=quarantine.

  • You inherited a domain with no DMARC

    Publish p=none with an aggregate report address. Find every shadow IT sender by reading the reports.

  • You are tightening a domain at p=none

    The reports show every sender passes. Generate at p=quarantine, give it a week, then move to p=reject.

Email Almanac

  • Not sure what this means?

    Ask a real person. The Email SOS Hotline is free help with any email problem, no pitch. Cleaning a list does not fix a DNS record, so if this check found a problem, start here.

    Ask the Email SOS Hotline

  • Keep this result

    Send it to your inbox, to share with your team or compare after a fix.

    Build it, then email it

  • Your setup is one half. Your list is the other.

    A record that passes proves the mail is yours. Mailbox providers also judge you on who you send to. Clean your first 1,000 addresses free.

    Clean your first 1,000 free