DMARC record generator: from monitoring to p=reject

Pick a policy and where reports should go, and copy a DMARC record that follows the standard. Runs in your browser; nothing is sent anywhere.

Policy for mail that fails
Alignment (leave relaxed unless you know you need strict)

Add this record at your DNS provider

TypeTXT
Host_dmarc
Valuev=DMARC1; p=none;
  • Without a report address (rua) you will not see who sends mail as your domain, which is what tells you when it is safe to tighten the policy.
  • Most DNS providers want just _dmarc in the host field and add your domain themselves.
  • A domain has one DMARC record. If _dmarc already has one, replace it.

Runs in your browser: nothing you type is sent anywhere.

The usual path to p=reject

  1. Publish p=none with a report address and collect reports for a few weeks.
  2. Make every legitimate sender pass SPF or DKIM with your domain aligned. The SPF generator and SPF checker help with the SPF side.
  3. Move to p=quarantine, optionally with pct=25 rising to 100.
  4. Finish at p=reject. Check the published record any time with the DMARC checker.

DMARC protects your domain's name from forgery. It does not fix sending to bad addresses: hard bounces from dead mailboxes still hurt your reputation, which is why lists are verified before large sends.

DMARC record generator FAQ

Which policy should I start with?

p=none. It changes nothing about delivery but makes receivers send you daily reports, so you can see every service sending as your domain before you start quarantining or rejecting anything.

Where does the DMARC record go?

A TXT record at _dmarc.yourdomain. Most DNS providers want just _dmarc in the host field and add the domain themselves.

Can reports go to a mailbox on another domain?

Yes, but that domain has to agree to receive them: it must publish a TXT record at yourdomain._report._dmarc.theirdomain with the value v=DMARC1. Report-processing services set this up for you.

What does pct do?

It applies quarantine or reject to only a share of failing mail, so you can tighten gradually, for example 25% and then 100%. It has no effect with p=none.

Do I need DMARC to send to Gmail and Yahoo?

Since 2024 both require bulk senders to publish a DMARC record; p=none is accepted. They also require SPF and DKIM to pass for your domain.

More free tools

  • MX lookup

    See a domain's mail servers and which provider runs them.

  • SPF checker

    Check the SPF record, its DNS lookup count and the all mechanism.

  • DMARC checker

    Read the DMARC policy, reporting address and what to tighten.

  • DKIM checker

    Find a domain's DKIM keys and check their length and status.

  • BIMI checker

    See whether inboxes can show your logo, and what is missing.

  • Disposable email checker

    Find out if a domain is a throwaway inbox service.

  • SPF record generator

    Build a correct SPF record for the services that send your email.

  • Free email verifier

    Check whether one address actually exists, with a live mailbox check.

A healthy domain is half of it. Verify the addresses too.

Free credits on sign-up. No card. You only pay for definite answers.

Start free