DMARC record generator
In short: Build a DMARC TXT record with the right policy and reporting address, and see plainly when p=none enforces nothing. Limit: It builds the record. It does not read your DMARC reports or tell you which senders are failing.
A DMARC record generator builds the TXT record that tells receivers what to do with mail failing SPF and DKIM. Pick a policy, add a reporting address, and publish the result at _dmarc on your domain. p=none turns reporting on but blocks nothing, and the generator says so.
Daily XML summaries of what passed and failed, per sending source. This is how you find the vendor nobody told you about that has been sending as your domain for a year. The files are unreadable by hand — point them at a parsing service.
Advanced options
Set sp=reject even while the main policy is relaxed — unused subdomains are a common spoofing route.
Roll out enforcement gradually. Only meaningful with quarantine or reject.
Your DMARC record
v=DMARC1; p=none
p=none enforces nothing. This record satisfies Google and Yahoo’s bulk-sender requirement and turns reporting on, but anyone can still spoof your domain. Read the reports for a few weeks, confirm every legitimate sender passes, then move to quarantine and then reject.
No reporting address set. Without rua= you get no visibility into who is sending as your domain, which is most of the value of DMARC.
Where this goes in DNS
- Type
- TXT
- Name / host
- _dmarc
- Value
- the record above
The hostname is _dmarc, not the root domain — that is the most common mistake. DMARC also needs SPF or DKIM already working to be useful, since it only decides what to do when those fail.
By SimpleVerifier Team · Last updated · Built in your browser; nothing you enter is sent to us
Sample result
This DMARC record tells receivers to quarantine failing mail from acme.example.
- Policy
- p=quarantine
- Publish at
- _dmarc.acme.example
- Reports to
- [email protected]
What this means for you
Publish it at _dmarc.acme.example to stop others sending as you; reports go to [email protected].
- None, quarantine or reject policies
- Report addresses written as mailto URIs
- Subdomain policy, pct and strict alignment
- Says plainly that p=none enforces nothing
- DMARC
- TXT record
- Policy
Why does p=none not protect my domain?
Because p=none asks receivers to deliver failing mail as normal and only send you reports. When Google and Yahoo began requiring DMARC on bulk senders in February 2024, a very large number of domains published v=DMARC1; p=none and considered the job done. That record satisfies the requirement. It also permits anyone on the internet to send mail that appears to come from the domain.
The protection arrives only at p=quarantine or p=reject. Getting there is not risky if you do it in order: publish p=none with a reporting address, spend two to four weeks reading what the reports show, fix or remove the senders that fail, then raise the policy. The reports are the part people skip, and they are the part that makes the move safe.
One shortcut worth taking immediately: set sp=reject even while your main policy is still none. Your unused subdomains send no legitimate mail, so there is nothing to break, and they are a favourite spoofing route precisely because nobody sets a policy on them.
How do I add a DMARC record to my DNS?
Create a TXT record with the host name _dmarc and paste the generated value as its content. Most DNS panels, including GoDaddy, Namecheap and Cloudflare, add your domain to the host name for you, so typing _dmarc.yourdomain.com in full can produce _dmarc.yourdomain.com.yourdomain.com. For Google Workspace and Microsoft 365 the record goes at your DNS host, not in their admin consoles, unless you still use the default onmicrosoft.com domain. A typical first record looks like v=DMARC1; p=none; rua=mailto:[email protected].
How do I check my DMARC record is working?
Look it up once DNS has updated, then read the first reports. DNS changes take minutes to hours to propagate. Once published, confirm it with the DMARC checker, and confirm the records it depends on with the SPF checker and DKIM checker. The full audit runs all of them at once and scores the domain.
If you do not have SPF yet, build that first with the SPF generator, because DMARC has nothing to act on until SPF or DKIM is in place.
How do I create a DMARC record?
- Choose a policy. Start with
noneto collect reports, then move toquarantineandrejectonce legitimate mail passes. - Add the address that should receive aggregate (
rua) reports. Separate several addresses with commas. - Optionally set a subdomain policy (
sp), a percentage (pct) and strict alignment. - Copy the record and publish it as a TXT record at
_dmarc.yourdomain.com, not on the root domain, then confirm it with the DMARC checker and read the reports before raising the policy.
Example
- You enter
- Policy quarantine, reports to
[email protected], subdomain policy reject. - You get
- The record
v=DMARC1; p=quarantine; rua=mailto:[email protected]; sp=reject, to publish as a TXT record at_dmarc.acme.example. - Limits
- No limits; the record is built in your browser.
What is the difference between p=none, quarantine and reject?
| Policy | What happens to failing mail | When to use it |
|---|---|---|
p=none | Delivered normally; you get reports | First, for two to four weeks of reports |
p=quarantine | Treated as suspicious, usually the spam folder | Once every legitimate sender passes |
p=reject | Refused during delivery | The goal: spoofed mail stops arriving |
Who uses this tool, and for what?
- IT admins
- Move the company domain from
p=nonetorejectin stages, so spoofed mail is refused without blocking a forgotten system that sends invoices. - Cold emailers
- Meet the Google and Yahoo bulk sender rule on every outreach domain. A
p=nonerecord with a reporting address is enough to start. - Agencies
- Publish DMARC on client domains during onboarding and set
sp=rejectso unused subdomains can't be spoofed while the main policy is still at none. - SaaS teams
- Protect the domain your customers receive receipts and alerts from, which is the one phishers most want to imitate.
What can’t this tool tell you?
- It builds the record. It does not read your DMARC reports or tell you which senders are failing.
- DMARC does nothing on its own. It needs SPF or DKIM to pass for a domain aligned with the From address.
- A reporting address on another domain only receives reports if that domain publishes an authorisation record for yours (RFC 7489, section 7.1). The generator does not create it.
- Strict alignment breaks mail from services that sign or bounce with a subdomain of yours. Leave it off unless you know every sender uses the exact domain.
Sources
Common questions
- Does DMARC require DKIM?
- No. DMARC passes when either SPF or DKIM passes for a domain aligned with the From address. DKIM is still worth setting up, because SPF fails when mail is forwarded and DKIM usually survives it.
- Is DMARC free?
- Yes. A DMARC record is a DNS TXT record, so publishing one costs nothing, and this generator is free. What can cost money is a service that collects and summarises the aggregate reports for you.
- What does a DMARC record look like?
- A minimal one is v=DMARC1; p=none; rua=mailto:[email protected], published at _dmarc.yourdomain.com. v= and p= are required; rua= tells receivers where to send reports. Stricter records raise p to quarantine or reject and may add sp= for subdomains.
- How do I create a DMARC record?
- Choose a policy, add an address for aggregate reports, and publish the result as a TXT record at _dmarc.yourdomain.com. The generator above builds the record and warns you when the settings will not actually enforce anything.
- What DMARC policy should I start with?
- Start at p=none with a reporting address. It cannot break legitimate mail, and the reports show you every source sending as your domain, usually including one or two you had forgotten about. Move to quarantine once those all pass authentication, then to reject.
- Where does the DMARC record go?
- At the hostname _dmarc on your domain, so _dmarc.yourdomain.com, as a TXT record. Putting it on the root domain instead is the most common DMARC mistake and means no receiver will ever find it.
- Is p=none enough for Google and Yahoo?
- Yes, technically. Since February 2024 both require a DMARC record on domains sending bulk mail, and p=none satisfies that. But it enforces nothing: anyone can still spoof your domain, and p=none was never meant to be a destination. It is the monitoring phase.
- Do I need SPF and DKIM before DMARC?
- Yes. DMARC does not authenticate anything itself; it only decides what happens when SPF and DKIM fail, and whether the domain that passed matches the visible From address. Publishing DMARC with neither in place means everything fails it, which is why you start at p=none.
- What is DMARC alignment?
- The requirement that the domain which passed SPF or DKIM matches the domain in the From header a recipient sees. It is what makes the other two records useful: without it a spammer could pass SPF for a domain they own while displaying yours. Relaxed alignment, the default, lets a subdomain match the parent; strict requires an exact match and often breaks email service providers.
Records published. Now the list itself.
Authentication stops your mail being forged. It does nothing about the dead addresses that get you throttled in the first place.
- Bulk verification with real SMTP mailbox checks
- Hard bounces removed before a send, not discovered after
- Catch-all, disposable and role detection on every row
Plans from $9 a month, cancel anytime, no contract. Sign in with Google and your first 100 email checks are free, no card. The free tools stay free either way.