Free DMARC record generator
Create the right DMARC record for your domain, starting with a safe monitoring policy, then add it and check that it works.
A mailbox or group you can check, or the address from a DMARC reporting service. Reports arrive daily, so a dedicated address helps. Separate several with commas.
Without a report address you can't see what's failing, so you won't know when it's safe to step up.
Advanced settings
Relaxed alignment lets mail sent from a subdomain, like news.yourbusiness.com, count for your main domain. Most businesses should leave these alone.
Your DMARC record
- Type
TXT- Host / Name
_dmarc- Value
v=DMARC1; p=none- TTL
Default, or 1 hour
Already have a DMARC record? Edit it instead of adding a second one. Two DMARC records cancel each other out.
Add it at your DNS host
Your DNS host is usually where you bought your domain. Pick yours for step-by-step instructions.
Added it? Changes can take up to a few hours to show up.
Check my recordA DMARC record is one TXT record at _dmarc.yourbusiness.com. Most businesses should start with v=DMARC1; p=none; rua=mailto: followed by an address you check. That policy blocks nothing. It sends you reports. After a few weeks of reports showing your real email passing SPF or DKIM, step up to p=quarantine, then p=reject.
How do I use this DMARC generator?
Enter your domain, choose a policy, and add the address where you want reports sent. The generator builds the record as you go. Copy the host name and value into a new TXT record at your DNS host, which is usually the company where you bought your domain.
Nothing you type leaves your browser. The generator doesn't look anything up or save your domain.
Which policy should I start with?
Start with Monitor (p=none) unless you already know every service that sends email as your domain passes SPF or DKIM. Then step up as your reports allow.
| Stage | Policy | What you do |
|---|---|---|
| Weeks 1 to 4 | p=none | Read your reports. List every service sending as you, like your email provider, newsletter tool, invoicing software and website forms. Fix any that fail. |
| Next 2 to 4 weeks | p=quarantine | Failing messages go to spam. Keep reading reports and watch for complaints that real email went missing. |
| After that | p=reject | Failing messages are blocked. This is full protection against people sending email as your domain. |
Microsoft and Google both recommend this gradual approach. If something breaks at any stage, step back one level, fix the sender, and try again.
What does each part of the record mean?
| Tag | Meaning | Example |
|---|---|---|
v | Marks this as a DMARC record. It must come first. | v=DMARC1 |
p | What providers do with email that fails | p=none, p=quarantine or p=reject |
rua | Where providers send daily summary reports | rua=mailto:dmarc@yourbusiness.com |
sp | A different policy for subdomains. Leave it out to use p. | sp=reject |
adkim, aspf | How closely DKIM and SPF domains must match your From address. Relaxed is the default. | adkim=s for strict |
If you send reports to an address on another domain, that domain has to publish a permission record before providers will send to it. DMARC reporting services handle this for you.
How do I add the record?
Follow the guide for your DNS host: GoDaddy, Cloudflare or Namecheap. For other hosts, our DMARC fix guide has steps for Squarespace, plus notes for domains set up through Google Workspace or Microsoft 365.
If you already have a DMARC record, edit it rather than adding a second one. Two records cancel each other out, and providers treat your domain as if it had none.
How do I know it's safe to move to quarantine or reject?
Your reports tell you. Each one lists the servers that sent email using your domain and whether they passed. When every service you recognize passes SPF or DKIM for a couple of weeks, you're ready for the next stage. Our guide to reading DMARC reports walks through what to look for.
What should you do next?
After you save the record, wait a few minutes, then run the free DMARC checker to confirm providers can see it. For a full picture of your email and website settings, run the free website security scan.
Common questions
Is p=none enough?
It's the right first step, but it doesn't stop anyone. With p=none, providers still deliver fake email that uses your domain. They just report it. Treat it as a few weeks of preparation before you move to quarantine.
Which email address should I use for DMARC reports?
Use a mailbox or group you can check, like dmarc@yourbusiness.com, or the address a DMARC reporting service gives you. Reports arrive as daily attachments, so keep them out of your main inbox.
Should I use the pct tag to ease in?
No. The current DMARC standard, RFC 9989, retired pct because providers applied partial percentages inconsistently. Step the policy itself from none to quarantine to reject instead.
Do I need SPF and DKIM before DMARC?
You can publish p=none at any time, and its reports will show you what's missing. Before quarantine or reject, though, every service that sends as your domain needs to pass SPF or DKIM, or your own email will be filtered.
Does a small business really need DMARC?
Google requires DMARC from bulk senders, which it defines as close to 5,000 or more messages a day to personal Gmail accounts. More importantly, it's the setting that stops strangers sending email as your domain. It's free, and adding it takes a few minutes.
Sources
- RFC 9989: Domain-Based Message Authentication, Reporting, and Conformance (DMARC) (RFC Editor)
- Set up DMARC (Google Workspace Admin Help)
- Email sender guidelines (Google)
- Set up DMARC to validate email in Microsoft 365 (Microsoft Learn)
Related guides and tools
Run the full free security scan
Check your website, email and domain together, with a prioritized plan and step-by-step fixes.
- Free check
- No signup
- No changes to your website