DMARC Generator
Choose a DMARC policy, add aggregate and forensic report addresses, and set alignment and failure reporting options. Copy the record and publish it at _dmarc on your domain.
Problems found
Your DMARC record
Host / name: _dmarc · Type: TXT
v=DMARC1; p=none
- Enter your domain, for example example.com.
- p=none only monitors. Review the reports, fix any legitimate senders that fail, then move to quarantine and reject.
- Add at least one aggregate report address (rua) so receivers send you daily summaries of who is sending as your domain.
Start with p=none and read the reports for a few weeks. Make sure SPF and DKIM pass for every legitimate sender before moving to quarantine and then reject. DMARC passes when SPF or DKIM passes and aligns with the From domain.
What is DMARC Generator?
A DMARC record tells receiving mail servers what to do with messages that fail SPF and DKIM alignment, and where to send reports about them. This generator builds the record from a policy (none, quarantine or reject), an optional subdomain policy, a percentage, aggregate report addresses (rua), forensic report addresses (ruf) and advanced alignment and failure options. It warns when a report address is on another domain and needs an authorization record. Start with p=none to collect reports, fix any legitimate senders that fail, and tighten the policy gradually.
Why use this tool?
- Choose a policy: none (monitor only), quarantine or reject.
- Set a separate policy for subdomains and apply the policy to only a percentage of failing mail while you roll it out.
- Add several aggregate (rua) and forensic (ruf) report addresses.
- Advanced options cover DKIM and SPF alignment, failure reporting options and the report interval.
How to use DMARC Generator
- Step 1. Enter your domain.
- Step 2. Choose a policy. Start with none while you collect reports.
- Step 3. Add at least one aggregate report address (rua), ideally a dedicated mailbox.
- Step 4. Open the advanced options if you need strict alignment, failure reporting options or a different report interval.
- Step 5. Copy the record and publish it as a TXT record at _dmarc on your domain.
- Step 6. Review the reports, fix legitimate senders that fail, then move to quarantine and reject.
Common use cases
Important notes
- A DMARC check passes when SPF or DKIM passes and the domain it uses aligns with the visible From domain.
- If a report address is on a different domain, that domain must publish an authorization record named yourdomain._report._dmarc.theirdomain with the value v=DMARC1. The tool shows the exact name.
- Forensic reports (ruf) are sent by few receivers and can contain parts of real messages, so treat them carefully.
- Record tags with their default values are left out unless you choose to write every tag.
- Only one DMARC record should exist at _dmarc on a domain.
More DNS & Website Tools
DMARC Generator FAQ
What is the difference between none, quarantine and reject?
None only monitors and takes no action. Quarantine asks receivers to treat failing mail as suspicious. Reject asks them to refuse it.
What are rua and ruf?
rua is where aggregate reports go, which are daily summaries of mail seen for your domain. ruf is where forensic reports about individual failures go, which few receivers send.
What is the difference between relaxed and strict alignment?
Relaxed allows a subdomain of the From domain to align. Strict requires an exact match of the domain.
What does the percentage do?
It applies the policy to only that share of failing mail, so you can roll out enforcement gradually.
Do I need DKIM and SPF before DMARC?
DMARC relies on at least one of them passing and aligning. Set up both, then use the reports to confirm your senders pass.