DMARC record generator
Build a valid DMARC record in a minute. Start with monitoring, then tighten to quarantine and reject once your reports are clean.
How to use it safely
- Publish
p=nonewith a reporting address. Nothing changes for delivery. - Read the reports for two to four weeks and fix each legitimate sender. How to read DMARC reports.
- Move to
quarantine, thenreject. The three policies explained.
Already have a record? Paste it into the DMARC explainer to see what it does.
Frequently asked questions
What DMARC record should I start with?
v=DMARC1; p=none; rua=mailto:you@yourdomain. It changes nothing about delivery and starts daily reports, so you can find every service that sends as your domain before enforcing.
Where do I publish a DMARC record?
As a TXT record named _dmarc at your DNS host, for example _dmarc.example.com. Publish exactly one DMARC record per domain.
When should I move to p=reject?
When two to four weeks of reports show every legitimate sender passing SPF or DKIM with alignment. Many teams go to p=quarantine first, then p=reject.
Related guides
Guide
SPF, DKIM and DMARC explained: the complete guide for MSPsHow the three email authentication records fit together, with real examples, alignment explained and a rollout plan that does not break mail.
DMARC p=none vs reject
DMARC p=none vs quarantine vs reject, in plain EnglishWhat each DMARC policy does to fake email, and a safe path from p=none to p=reject.
DMARC subdomain policy
DMARC for subdomains: how sp= and policy inheritance workWhich policy applies to mail.example.com, when to set sp=, and how to protect subdomains attackers like to use.