DMARC record generator: the TXT record to publish

Home › Free tools › DMARC record generator

Choose a policy, where reports go and how strict alignment is. Get the exact TXT record to publish at _dmarc on your domain, checked against RFC 7489, and where to paste it at your DNS provider. The record is built in your browser.

Using the generator

Type your domain, then pick a policy: monitor only (p=none), send to spam (p=quarantine) or block (p=reject). Add the address for aggregate reports (rua), and open the advanced options for a percentage (pct), a different policy for subdomains (sp), strict alignment (adkim, aspf) or failure reports (ruf, fo). The record updates as you type, with the host name to publish it at and a copy button. Check my current record reads the record the domain publishes today and loads it into the form.

Short answer: A DMARC record is one TXT record at _dmarc.yourdomain.com. The smallest valid one is v=DMARC1; p=none, and the useful first one adds an address for reports: v=DMARC1; p=none; rua=mailto:dmarc@acme.com. Read the reports, fix every service that fails, then move to p=quarantine and finally p=reject.

What each policy does

p=none (monitor only): Deliver it as usual and send me reports. Nothing changes for your mail; you start seeing who sends as your domain.
p=quarantine (send to spam): Treat it as suspicious: usually the spam folder. Forged mail stops reaching inboxes, and a misconfigured sender of yours lands in spam rather than vanishing.
p=reject (block): Refuse it at the door. Forged mail is never delivered. So is real mail from any service of yours that is not set up yet.

Only p=quarantine and p=reject stop someone sending email that looks like yours. On 30 October 2026, only 46.7% of 478 ranked fintechs had their DMARC at p=reject (fintech email security benchmark).

The recommended path

Start at p=none with a rua address: v=DMARC1; p=none; rua=mailto:dmarc@acme.com. Leave it long enough for the reports to cover a full sending cycle, monthly mail such as invoices and newsletters included.
Fix what the reports show. Every service that sends as your domain (your mailbox provider, your CRM, your billing tool, your cold email tool) needs SPF or DKIM that passes and aligns with the From domain.
Move to p=quarantine, with pct if you want to ramp: v=DMARC1; p=quarantine; pct=25; rua=mailto:dmarc@acme.com. Raise pct to 100, then remove it.
Finish at p=reject: v=DMARC1; p=reject; rua=mailto:dmarc@acme.com.

Google and Yahoo ask bulk senders for a DMARC record and accept p=none. The email setup checker shows what a domain publishes today and grades it.

The tags

Tag	What it sets	Values	Default when left out
v	Version. Must be first, spelled exactly DMARC1	DMARC1	Required
p	Policy for the domain. Comes right after v	none, quarantine, reject	Required
sp	Policy for subdomains	none, quarantine, reject	Same as p
pct	Share of failing mail the policy applies to	0 to 100	100
rua	Where aggregate reports go	mailto: addresses, comma-separated	No reports
ruf	Where failure reports go	mailto: addresses, comma-separated	No reports
adkim	DKIM alignment	r (relaxed), s (strict)	r
aspf	SPF alignment	r (relaxed), s (strict)	r
fo	When to send a failure report	0, 1, d, s, joined by colons	0

The generator leaves out every tag at its default, so the record says only what you chose. It checks the record against RFC 7489: v=DMARC1 first, p= second, and only the values above.

Reports sent to another domain

If rua or ruf points at a different domain, such as a DMARC report service, that domain has to say it accepts your reports (RFC 7489, section 7.1). It publishes a TXT record at yourdomain.com._report._dmarc.theirdomain.com with the value v=DMARC1. Report services do this for their customers. If the address is on a second domain of your own, add that record yourself; the generator shows it.

Where to paste it

Cloudflare: Open the domain, then DNS, then Records, and add a record. Type: TXT. Name: _dmarc (Cloudflare adds the domain). Content: the value, without quotes. TTL: Auto. There is no proxy setting for TXT records.
GoDaddy: Open the domain’s DNS page and add a new record. Type: TXT. Name: _dmarc. Value: the value. TTL: 1 hour or the default. GoDaddy adds the domain to the name for you.
Namecheap: Domain List, Manage, then Advanced DNS, and add a new record. Type: TXT Record. Host: _dmarc. Value: the value. TTL: Automatic. Save with the tick.
Porkbun: Open DNS for the domain. Type: TXT. Host: _dmarc (leave the domain off; Porkbun shows it after the box). Answer: the value. Leave the TTL as it is.
Squarespace (was Google Domains): Domains moved from Google Domains to Squarespace. Open the domain, then DNS, then Custom records, and add a record. Host: _dmarc. Type: TXT. Data: the value.
Any other provider: Add a TXT record. Most providers want only _dmarc as the name and add the domain themselves; if yours asks for the full name, use _dmarc.yourdomain.com. Paste the value without quotes unless the form asks for them. Keep one DMARC record: edit an existing one rather than adding a second.

DNS changes usually show within minutes. A resolver that cached the old answer can take longer, up to that answer's TTL. Then press Check my current record to confirm it.

What it leaves out

It does not read your reports. Point rua at a mailbox you read, or at a DMARC report service.
It does not check SPF or DKIM. DMARC passes only when one of them passes and aligns: the email setup checker reads both, and the SPF lookup counter counts SPF's DNS lookups.
It follows RFC 7489, the DMARC standard receivers implement. Tags outside it are flagged and receivers that follow it ignore them.

Frequently asked questions

What is the difference between p=quarantine and p=reject?

Quarantine asks receivers to treat failing mail as suspicious, which usually means the spam folder. Reject asks them to refuse it, so it is never delivered. Quarantine is the safer step first: a sender you forgot to set up lands in spam rather than disappearing.

What does pct do in a DMARC record?

It applies the policy to that share of failing mail. At p=quarantine with pct=25, a quarter of failing mail is quarantined and the rest is delivered as if the policy were none. At p=reject, the rest is quarantined. It has no effect at p=none.

What is the difference between rua and ruf?

rua receives aggregate reports: a daily summary, per receiver, of which servers sent as your domain and whether they passed. ruf receives failure reports about single messages. Most large mailbox providers send no failure reports, so rua is the one that matters.

Can a domain have two DMARC records?

No. With more than one DMARC record at _dmarc, receivers apply no DMARC policy at all (RFC 7489, section 6.6.3). Edit the record you have rather than adding a second.

Do subdomains need their own DMARC record?

No. A subdomain without its own record is covered by the main domain's record, under sp if it is set and p if it is not. A subdomain that publishes its own record uses that one instead.

What do adkim and aspf change?

They set how closely the DKIM signing domain and the SPF domain must match the From address. Relaxed (r, the default) accepts a subdomain, such as mail.acme.com for acme.com. Strict (s) needs the exact domain. Most senders keep relaxed.

ROI Maximizer is a trading name of M Ventures LTD, registered in England and Wales, company no. 15554493. Registered office: 4 Beau Street, Bath BA1 1QY, United Kingdom. moe@roimaxi.com