DMARC record generator

Pick what you want receivers to do and get the DMARC record to paste. Give us the domain as well and we edit the record it publishes today, keeping every tag we did not come here to change.

Your domain

Optional, and the reason to give it: we read the DMARC record this domain publishes right now and edit that one, keeping every tag we did not come here to change.

What do you want receivers to do?

Monitor, p=noneNothing changes for your mail. Receivers start sending reports about it. Start here.
Quarantine, p=quarantineReceivers put mail that fails in the spam folder, including yours if it fails.
Reject, p=rejectReceivers refuse mail that fails at the door. The end goal, and the strictest setting.

Where should the reports go?

Any mailbox you read. Each receiver mails one XML file a day to this address. An address on this domain needs no extra setup.

Leave this empty and the record does nothing. p=none enforces nothing by design, so the reports are the entire point of publishing it. Without a rua= tag, no receiver sends you a report, and you learn nothing.

Any mailbox works. Ours is one you do not have to open: we parse every report and mail you one summary a week, with an alert the day a new sender fails on the paid plans.

Alignment, subdomains and pct

Subdomain policy

Same as the parentThe default. Subdomains inherit the policy above.
sp=noneSubdomains are monitored only, whatever the parent does.
sp=quarantineFailing subdomain mail goes to spam.
sp=rejectFailing subdomain mail is refused.

DKIM alignment

adkim=r, relaxedThe default. Any subdomain of your domain aligns.
adkim=s, strictThe signing domain has to match the From domain exactly.

SPF alignment

aspf=r, relaxedThe default. Any subdomain of your domain aligns.
aspf=s, strictThe bouncing domain has to match the From domain exactly.

Percentage of failing mail the policy applies to

Leave it empty for all of it. Anything lower gives the rest the next policy down, so reject sends it to spam and quarantine delivers it.

What a DMARC record generator gives you

What does a DMARC record generator do? It gives you the TXT record to publish at _dmarc.yourdomain.com. In that record, you set the policy for mail that fails DMARC and the address for your daily reports.

Most records need just p= and rua=. In p=, you set the policy. With none, receivers deliver failing mail anyway. With quarantine, they send it to spam, and with reject, they refuse it. In rua=, you give the address for aggregate reports. You can leave the other tags out. They're under "Alignment, subdomains and pct" in the form.

Editing the record you already have

Give us your domain and we read the record you publish now. We add your reporting address to the rua= list and keep the addresses already on it, so a tool that gets your reports today keeps getting them. We change the policy where it sits in the record.

We don't touch any other tag. We copy pct, sp, fo, ruf, ri, adkim and aspf exactly as they are, and mark what we changed so you can check it.

A domain gets one DMARC record. If you publish a second one at the same name, receivers ignore both. Replace the one you have now with the record above. Don't publish it as a second record.

Starting at p=none

Is p=none worth publishing? Yes, and it's the safe first record. Most domains have at least one sender the owner forgot about, such as the invoicing app, the CRM or a survey tool a contractor set up. At p=none, receivers still deliver that mail and list it in your reports. If you publish p=reject before you've read those reports, you can block your own invoices. The DMARC setup guide covers each step up to p=reject and the numbers to check before each one.

The reports are XML files. Each receiver sends one a day to the address in rua=. Reading one by hand covers what's in them. Paste one into the report analyzer to see it as a table.

How SPF and DKIM affect DMARC

DMARC has no check of its own. It passes when SPF or DKIM passed for the domain in your From line. That match is called alignment. A platform can pass SPF under its own domain and still fail DMARC for yours.

Set up SPF and DKIM for every sender before you tighten the policy. Build your SPF record with the SPF record generator, and find the DKIM setup for each platform on the provider pages. Then look up all three records with the combined checker.

Who reads your DMARC reports?

Any mailbox can take the reports, but they arrive as raw XML. We read every file, mail you a summary each Monday and, on a paid plan, email you the day a new sender fails.

Send them to us instead

Free for your first domain · No card · Per-source totals kept for life

The other tools

DMARC checkerFree, no signup. SPF checkerFree, no signup. DKIM checkerFree, no signup. SPF, DKIM and DMARC checkerFree, no signup. DMARC report analyzerFree, no signup. Paste the XML. SPF record generatorFree, no signup. Merges, never replaces. SPF change pre-flightFree, no signup. Diff a record before you publish it. Email header analyzerFree, no signup. Paste the headers of one message.