Free tool
DMARC generator
Build the DMARC record for your domain. Enter it to start from what's published now, or start from scratch below.
More options
Publish this record
- Type
- TXT
- Host
_dmarc.yourdomain.com- Value
v=DMARC1; p=none
Some DNS hosts want only _dmarc as the host; they add your domain themselves.
- ✓Monitoring only: nothing is blocked yet. That's the right first step. Move to quarantine once the reports show only your own services sending.
- !No report address, so the monitoring has nobody to tell. Add one: the reports are how you'll know when it's safe to enforce.
Published it? Check it with the DMARC checker →
Sending outreach from this domain? GEOboom finds the pages AI answers cite and runs the outreach to get you mentioned on them, with the mailboxes included.
See how it worksFrom monitoring to reject
Weeks 1 to 4: monitor
Publish p=none with a report address. The reports list every server sending as you; fix SPF and DKIM for any of your own that fail.
Then: quarantine
Once the reports show only your own services passing, move to p=quarantine. Failing mail goes to spam, where a mistake is still recoverable.
Finally: reject
After a quiet few weeks, p=reject. Mail that claims to be from your domain and fails is refused outright.
Questions
What should my first DMARC record be?
v=DMARC1; p=none; rua=mailto:a-mailbox-you-read. It blocks nothing and asks receivers to send you daily reports of every server sending mail as your domain. Leave it for two to four weeks, fix any of your own services that fail, then move to quarantine and later reject.
Where do I add the DMARC record?
In your DNS host's panel, as a TXT record on the host _dmarc. Some panels want just _dmarc and add your domain themselves; others want the full _dmarc.yourdomain.com. A domain must have exactly one DMARC record: if one exists, edit it rather than adding another, because with two, receivers ignore both.
What's the difference between p=none, quarantine and reject?
They tell receivers what to do with mail that fails DMARC. none: deliver it as usual and just report it. quarantine: put it in spam. reject: refuse it outright. Only quarantine and reject actually stop someone sending as your domain; none is for watching first, so your own mail doesn't get caught.
Which email address should receive the reports?
One that somebody or something reads. The reports are XML attachments, one per receiver per day, and a busy domain gets many. A dedicated mailbox such as dmarc-reports@yourdomain.com works for a small domain; a DMARC report service turns them into charts. If the address is at another domain, that domain has to publish a small record allowing it, which we show when it's needed.
How does this generator build the record?
It writes v=DMARC1 and your policy, then only the tags that change something: sp= when subdomains differ, pct= below 100, rua= and ruf= for reports, and adkim= or aspf= when set to strict. Tags left at their default are left out, since they mean the same either way. If you enter your domain, it reads the record already published at _dmarc.yourdomain.com and starts from that, so the result replaces your record instead of becoming a second one.
Should I use strict alignment?
Almost never. Relaxed alignment, the default, counts mail signed or sent from any subdomain of your domain as yours, which is what most setups need. Strict requires an exact match, and quietly fails mail from services that send from a subdomain such as mail.yourdomain.com.