DMARC Record Generator
Build a DMARC TXT record for _dmarc with policy, reporting, and alignment options.
v=DMARC1; p=none
Publish as a TXT record on _dmarc.yourdomain.com. Start with p=none and rua reports before moving to quarantine or reject.
About the DMARC Record Generator
The DMARC Record Generator builds a TXT record for the _dmarc subdomain from your policy, reporting addresses, and alignment settings. DMARC tells receivers what to do when SPF or DKIM fail and where to send aggregate reports about your mail.
A typical rollout starts with p=none and an rua mailbox so you can see who sends as your domain. Once SPF and DKIM are aligned for legitimate traffic, move to quarantine or reject to block spoofing. The generator outputs the exact string to paste into DNS.
The record is assembled in your browser only. Nothing is uploaded. Pair this with Email Health to confirm _dmarc is visible after propagation and to read notes on your current policy.
DMARC works with SPF and DKIM; it does not replace them. Publish SPF first, enable DKIM signing with your mail provider, then add DMARC to set enforcement and reporting.
Reach developers and designers who use these tools every day. Privacy-first, no trackers.
Frequently asked questions
Where does the DMARC record go?
Create a TXT record on the _dmarc host of your domain. For example.com that is _dmarc.example.com. Some panels show the name as _dmarc and append the domain automatically.
What is rua?
rua is the address (or addresses) that receive aggregate DMARC reports. Use a mailbox you monitor or a provider that ingests DMARC XML reports. The generator adds the mailto: prefix if you omit it.
When should I use p=reject?
Move to reject only after p=none reports show that legitimate mail passes SPF and DKIM alignment. Reject tells receivers to drop failing messages outright.
Is this uploaded to a server?
No. The record is built locally in your browser.
What are adkim and aspf?
They control alignment strictness. Relaxed (r) allows organizational domain matches; strict (s) requires an exact domain match. Most deployments use relaxed unless you have a specific reason for strict.