Free tool · Generate

DMARC record generator

Choose your policy and report addresses and copy a valid DMARC record. Every option says what it does.

Your DMARC record

Type: TXT
Host: _dmarc
Value: v=DMARC1; p=none

v=DMARC1: Marks this as a DMARC record. Always first.
p=none: Nothing changes for delivery. You get reports. Start here.

Add a report address, or you’ll never see whether your mail passes.

Fix this by sending through Groundmail

Add your domain and we give you the exact SPF, DKIM, DMARC and return-path records, check them for you, and sign every message with your own domain's key. Free for 3,000 emails a month.

Start sending free Domain setup docs

A safe rollout

Publish p=none with a rua address first. Watch the reports for a couple of weeks, fix any service of yours that fails, then move to p=quarantine and finally p=reject.

Publish the record as a TXT record at _dmarc.yourdomain.com. A domain can only have one.

Go deeper: Google, Yahoo and Microsoft sender rules

Questions

What should my first DMARC record be?

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com. It changes nothing about delivery and starts the reports that tell you whether it's safe to enforce.

What does pct do?

Applies the policy to only that share of failing mail, so you can move to quarantine or reject gradually. It has no effect with p=none.

What is the sp tag?

The policy for subdomains. Without it, subdomains inherit p. Set sp=reject to block spoofing of subdomains you never send from.