DMARC Record Generator

Build a DMARC record for your domain. Choose a policy, add a reporting address, and get the exact TXT record to publish — along with a plain statement of what it will actually block.

If you are starting from nothing, publish p=none with a reporting address first. It blocks nothing, but it tells you who is sending mail as your domain, which is the information you need before tightening anything.

How it works

DMARC ties SPF and DKIM to the From: address recipients actually see, and tells receiving servers what to do when authentication fails. It is published as a TXT record at _dmarc.yourdomain.com — not at the domain root, which is where SPF lives. Publishing DMARC content at the root does nothing at all.

The rollout that works, in order:

1. p=none with rua — collect aggregate reports for two to four weeks. You will almost certainly discover senders you had forgotten: invoicing, monitoring, a CRM, an old application server.
2. Fix alignment for each legitimate sender, so SPF or DKIM passes on your domain rather than the platform's.
3. p=quarantine — failing mail goes to spam. Watch reports.
4. p=reject — failing mail is refused. This is the only setting that actually stops your domain being spoofed.

Two options are worth understanding before you set them:

• Alignment (aspf, adkim). Relaxed is the default and allows subdomains to satisfy alignment — mail from mail.example.com aligns with example.com. Strict requires an exact match. Start relaxed; strict breaks many legitimate setups.
• sp sets the subdomain policy. Without it, subdomains inherit p. Publishing p=reject alongside sp=none leaves every subdomain freely spoofable, which is rarely what anyone intends.

The reporting address can be at any domain, but if it is outside the domain the record covers, that other domain must publish an authorisation record. Sending reports to an address on the same domain avoids the complication entirely.

Frequently asked questions