Free tool
DMARC record generator
Gmail, Outlook and others send daily reports there. Several addresses can be separated by a comma.
Advanced settings
100 for all. Less to go step by step when moving to quarantine or reject.
Few providers send them, and they may contain parts of messages.
Your record
v=DMARC1; p=none
Where does it go?
- Host
- _dmarc
- Type
- TXT
Only one DMARC record per domain. If you already have a record starting with v=DMARC1, replace it with this one.
The recommended path
1Start with p=none
With a report address, for two to four weeks. Read the reports and make sure everyone who sends in your name passes SPF or DKIM.
2Then quarantine
Once all your real mail passes. You can start with a pct below 100.
3Then reject
Once the reports show only forged mail. Now nobody can spoof your domain.
Before quarantine or reject: SPF and DKIM must pass for your mail first, or your real messages get refused.
After publishing: check the recordCreate a correct SPF record
What is DMARC?
DMARC is a text record (TXT) on the host _dmarc in your domain's DNS. It tells receiving servers: if a message carries my domain in the From field and passes neither SPF nor DKIM, do this: nothing (none), put it in spam (quarantine), or refuse it (reject).
DMARC also asks these servers to send you daily reports: who sent in your domain's name, from which server, and whether it passed or failed. That way you see who spoofs your domain, and also your own services that are not set up yet.
How does it work with SPF and DKIM?
SPF checks the sending server, DKIM checks the message's signature. DMARC checks nothing new: it requires at least one of them to pass, and the domain that passed to be the same as the one in the From field (this is called alignment).
So set up SPF and DKIM first for every service that sends in your name, then add DMARC. Without them, your real mail gets refused once you tighten the policy.
The recommended path and common mistakes
Start with p=none and a report address, for two to four weeks. Once all your real messages pass in the reports, move to quarantine, then to reject.
Common mistakes: starting straight with reject before every service is set up, so real messages get lost. Staying on p=none forever, so there is no real protection. Writing the record on the domain itself instead of the host _dmarc. Or using a report address on another domain without that domain allowing it.
SPF record generatorCheck your domain's DNS and e-mail
Frequently asked questions
Where do I put the DMARC record?
In your domain's DNS, as a TXT record on the host _dmarc (that is, _dmarc.example.com). The value is the record you copy from the tool.
Which policy should I start with?
p=none with a report address. Nothing changes in how your mail arrives, and you learn who sends in your name. After two to four weeks, move to quarantine, then reject.
Do I need SPF and DKIM before DMARC?
Yes. DMARC relies on them. Without them your real messages fail once the policy is quarantine or reject.
The reports are hard to read. What can I do?
They are XML files. You can send them to a DMARC report service that shows them as clear tables. If the service is on another domain, the tool shows the authorisation record it needs.
What is the difference between rua and ruf?
rua is for the daily aggregate reports, the important ones. ruf is for detailed reports on each failed message, and few providers send them.
Do you keep my domain or e-mail address?
No. The record is built in your browser. The "Read current record" button only asks DNS about the domain, and we keep nothing.