DMARC record generator: build your _dmarc record in one minute

Pick a policy, enter a report address and copy the record. A DMARC record is a TXT record at _dmarc.yourdomain.com that tells receivers what to do with email that fails both SPF and DKIM, and where to send reports. Start with p=none, read the reports, then tighten to quarantine and reject.

The generator builds the value live as you choose. What each tag means is shown next to the field; the order in which to tighten the policy is at the bottom.

The domain you send from (the part after the @). The record goes at _dmarc.<domain>.
Start with none. Move to quarantine/reject once your own mail passes completely in the reports.
Receives daily aggregate reports (XML) from Gmail, Outlook and others. Strongly recommended.
Individual failure reports. Most major providers no longer send them; feel free to leave empty.
Only fill in if subdomains should get a different policy.
Share of mail the policy applies to. Useful to move gradually to reject; 100 is the end state.
Relaxed allows subdomains in the DKIM signature; strict requires exactly the same domain.
Relaxed allows subdomains as envelope sender; strict requires exactly the same domain.
_dmarc.uwdomein.be
v=DMARC1; p=none
Copied

Putting the record live — and tightening it safely

DMARC only works once SPF and DKIM are already in place. Publish the record, wait for reports and raise the policy in steps.

1

Publish the TXT record

In the DNS management of your registrar or hosting panel, create a TXT record named _dmarc (or _dmarc.yourdomain.com, depending on the panel) with the value above.

2

Read reports for two weeks

The reports show which sources send on behalf of your domain and whether they pass SPF/DKIM. Anything legitimate that fails must be fixed first.

3

Raise to quarantine and reject

Once your own mail passes everywhere, set p=quarantine (optionally with pct), and after a quiet period p=reject. Your domain is then protected against abuse.

Check your records SPF, DKIM & DMARC explained See 2Mail

Frequently asked questions about DMARC records

With p=none and a rua report address. You block nothing yet, but you receive reports showing which sources send on behalf of your domain. Only once all your legitimate mail passes do you move to quarantine and then reject.
In the DNS management of your domain, at your registrar or hosting panel: a TXT record named _dmarc (some panels want _dmarc.yourdomain.com) with the text from the generator as its value. Changes are usually visible within an hour.
Not necessary. Forensic reports (ruf) contain copies of individual messages and most major providers no longer send them for privacy reasons. The rua address with aggregate reports is enough.
pct sets the percentage of mail the policy is applied to. With pct=25 under p=quarantine, a quarter of failing mail is quarantined and the rest treated as none. Useful to tighten gradually; the end state is 100.
No. DMARC builds on SPF and DKIM: it asks the receiver to check that at least one of them passes and is aligned with the sender domain. Without those two, all mail fails under a strict policy — including your own.
Call us
Send an email