DMARC Record Generator
Build a DMARC record — starting where you should, not where you want to end.
Result
ISSUEDMARC record with p=none
Publish this as a TXT record on the _dmarc subdomain. The order it belongs in is monitoring first, enforcement later: p=none with an aggregate address changes nothing about delivery and tells you which of your own systems are failing authentication — which is knowledge you need before enforcing, because the ones you have forgotten are exactly the ones that stop arriving.
v=DMARC1; p=none
- Host nameThe DNS name the TXT record goes on
- _dmarc.yourdomain.com
- Policy
- none
- Aggregate reports
- none
- Problem
- No aggregate report address. Without rua you receive nothing, which means you cannot see which of your own senders are failing — and enforcing a policy blind is how legitimate mail disappears.
- Note
- p=none monitors without affecting delivery. Run it for a few weeks, read the aggregate reports, and move to quarantine only once every legitimate sender passes.
What this cannot tell you
- Builds a record from your choices. It does not check whether your mail currently passes — publishing enforcement before knowing that is the mistake this tool is written to prevent.
- DMARC only works when SPF or DKIM aligns with the domain in the visible from address. A message can pass SPF for a provider's domain and still fail DMARC for yours.
- Aggregate reports arrive as XML from every participating receiver. Reading them by hand is possible for a small domain and unpleasant for a large one.
- Nothing here is transmitted. The record is assembled in your browser.
Take this with you
How this lookup works
You choose a policy and a reporting address and the record is assembled. The advice attached to each choice is the point of the page. Publishing p=reject is the destination and a bad starting point: everything you have forgotten — an invoicing system, a newsletter platform, a form on an old site — stops being delivered immediately and silently, and you find out from customers. Starting at p=none with an aggregate address changes nothing about delivery and tells you which of your own senders fail, which is the knowledge that makes enforcement safe.
What the results mean
- p=none
- Monitor only. Nothing changes for delivery and reports start arriving. The correct first step for any domain.
- p=quarantine
- Failing mail goes to spam. The intermediate step, once reports show your own senders passing.
- p=reject
- Failing mail is discarded. The destination, and the setting that causes damage when published early.
- rua
- Where aggregate reports go. Without it you are enforcing blind, which is the most common way legitimate mail is lost.
- Strict alignment
- Requires an exact domain match rather than an organisational one, so subdomains stop aligning. Rarely needed, frequently breaks things.
Common problems and fixes
- We published reject and lost mail
- Go back to p=none, read the aggregate reports for a few weeks, fix every sender that fails, then move up in steps. There is no shortcut that avoids that.
- The reports are unreadable XML
- They are meant for tooling. A parser or a hosted service turns them into a list of senders — the useful output is which sources fail alignment, not the raw file.
- Mail from our newsletter platform fails
- Almost always alignment rather than authentication: the platform passes SPF for its own domain. You need a custom sending domain, or DKIM signed with your domain.
Frequently asked questions
What DMARC policy should I start with?
p=none with an aggregate reporting address, always. It has no effect on delivery and starts the flow of information you need — which of your systems send mail, and which of them fail alignment. Move to quarantine when the reports are clean, and to reject after that. Every guide that starts at reject is describing where you are going rather than how to get there.
Where does the DMARC record go?
On the _dmarc subdomain as a TXT record — so _dmarc.example.com for example.com. One record only; a second is treated as a configuration error and DMARC is skipped entirely.
Do I need SPF and DKIM both?
DMARC passes if either aligns, so strictly you need one. In practice both is much safer: SPF breaks whenever mail is forwarded, and DKIM survives forwarding but breaks when a mailing list rewrites the message. Together they cover each other's failure modes.
Put this on your own site
Free to embed, no attribution required beyond the source link the frame carries itself. It runs entirely in your visitor's browser, sets no cookies and loads no third-party script.
<iframe src="https://runthetests.com/embed/dmarc-generator/" width="100%" height="560" style="border:1px solid #e5e5e5;border-radius:8px" title="DMARC Record Generator" loading="lazy"></iframe>
Preview it at https://runthetests.com/embed/dmarc-generator/. Embedded pages are marked noindex, so yours stays the canonical copy — not this one.