Tooldeon

DMARC record generator

Choose what receivers should do with mail that fails DMARC and where to send reports, and copy the record for the _dmarc host of your domain. Tags that would only repeat a default are left out to keep the record short.

Policy (p)
Daily summary reports. One or more email addresses, separated by commas.
Optional reports on single failed messages. Many receivers do not send them.
A whole number from 0 to 100. Use less than 100 to roll out quarantine or reject gradually.
DKIM alignment (adkim)
SPF alignment (aspf)

Publish this as a TXT record on the host _dmarc of your domain, for example _dmarc.example.com. The fo option is added only when failure report addresses are set.

Runs in your browser: nothing you enter is sent anywhere.

How to use it

  1. Choose the policy. Begin with none if you have not used DMARC before.
  2. Enter an address that will receive the aggregate reports.
  3. Adjust the subdomain policy, percentage and alignment only if you need to.
  4. Copy the record into a TXT record at _dmarc on your domain.

How it works

A DMARC record is a list of tag=value pairs separated by semicolons, always starting with v=DMARC1 and p. Report addresses are written as mailto: links, several separated by commas. Receivers look the record up at _dmarc. plus the domain in the From address.

Example

With policy quarantine, reports to dmarc-reports@example.com and the policy applied to 25 % of failing mail, the record is:

v=DMARC1; p=quarantine; pct=25; rua=mailto:dmarc-reports@example.com

Common mistakes

  • Publishing the record on the domain itself instead of on _dmarc.
  • Jumping straight to reject before the reports show that all your senders pass.
  • Forgetting a newsletter or billing service that sends as your domain without DKIM for it.

Frequently asked questions

What does DMARC do?

It tells receiving mail servers how to handle messages that claim to come from your domain in the visible From address but fail both SPF and DKIM checks with an aligned domain, and where to send reports about them. It builds on SPF and DKIM, so set those up first.

Which policy should I start with?

Start with p=none and an rua address. The reports show which services send mail as your domain. When every legitimate sender passes, move to quarantine and then reject, optionally with pct below 100 for a gradual change.

What is alignment?

Relaxed alignment accepts a subdomain match, so mail.example.com aligns with example.com; strict requires the exact same domain. Relaxed is the default and suits most setups.

Can reports go to another domain?

Yes, but the receiving domain must publish a record that agrees to take them, named yourdomain._report._dmarc.otherdomain. Report services give their own instructions for this.

Why is my record missing some tags?

Tags at their default value add nothing, so the tool leaves out sp when it matches p, pct=100, adkim=r, aspf=r and fo=0. Receivers treat a missing tag as its default.

More in Developer

All tools in this category: Developer ·Updated November 4, 2026

Privacy choices

Google Analytics shows us which tools are used and whether they work. It may set cookies. Your choice is kept in this browser.