DMARC record generator
Write a DMARC record step by step, with the rollout most domains follow: monitor first, then quarantine, then reject.
What this generator writes
A DMARC record is a TXT record at _dmarc.yourdomain. It always starts with v=DMARC1 and the policy p, followed by optional tags. This page writes only the tags you change from their defaults, so the record stays short and easy to read: pct appears only below 100, adkim and aspf only when strict, and fo only when you ask for failure reports.
The rollout most domains follow
Monitor. Publish p=none with a rua address. Within a day or two, receivers start sending daily aggregate reports listing every IP that sent mail as your domain and whether SPF and DKIM passed and aligned. Use them to find every legitimate sender: your mailbox provider, marketing platform, CRM, help desk, billing system. Fix SPF and DKIM for each.
Quarantine. When the reports show your real mail passing, switch to p=quarantine. Using pct=25, then 50, then 100 limits the damage if you missed a sender.
Reject. Finally move to p=reject. Spoofed mail using your domain is now refused, and you meet the DMARC requirement for BIMI logos.
Why it matters
Since February 2024, Gmail and Yahoo require bulk senders to publish DMARC (p=none is accepted) and to send with a From domain that aligns with SPF or DKIM. Beyond those rules, an enforcing policy is the only thing that stops other people sending mail that looks like it came from you.
Common mistakes
- Jumping straight to
p=rejectwithout reading reports, and blocking your own invoices or newsletters. - Leaving out
rua, so there are no reports to read. - Publishing the record at the domain itself instead of at
_dmarc. - Sending reports to another domain that hasn't authorised them.
- Choosing strict alignment (
adkim=s,aspf=s) without checking that every service signs and sends with exactly your domain, not a subdomain. Relaxed alignment is right for most domains.
Once it is live, confirm it with the DMARC checker.
Questions
Where do I publish the record?
As a TXT record named _dmarc on your domain, so its full name is _dmarc.example.com. Many DNS panels add the domain for you: enter just _dmarc as the host.
How long should I stay at p=none?
Until the aggregate reports show all of your legitimate mail passing DMARC, typically a few weeks so that monthly senders (invoices, newsletters) show up. There is no fixed rule; the reports tell you when you are ready.
What does pct do?
It applies the policy to only that share of failing mail; the rest is treated one step more leniently. p=quarantine; pct=25 quarantines a quarter of failing mail. It lets you tighten gradually. Leave it out (100%) once you are confident.
Should I ask for failure reports (ruf)?
Optional. They can contain parts of real messages, and many large receivers, Gmail among them, don't send them. Aggregate reports (rua) are the ones you need.
Can reports go to another company's address?
Yes, but that domain must publish an authorisation record at yourdomain._report._dmarc.theirdomain. DMARC reporting services set this up for you.
Your DNS is right. Now see how real people react to your email
simmail sends your app's mail to simulated people who open, ignore, junk, click and reply, so you can test what happens after delivery. Start free, no card.