DMARC Record Generator
Related tools
Only affects failure (ruf) reports and needs a ruf address. Most large providers do not send these; fo=1 is the useful choice.
Domain and policy are required.
Related reading
- Reading DMARC Reports: Turn Raw XML Into a Path to p=rejectDMARC aggregate reports arrive as compressed XML nobody can read by hand. Learn how to parse them, spot spoofers, and safely move your domain to p=reject.
- BIMI Records Explained: Getting Your Logo to Show Up in the InboxHow BIMI puts your verified logo next to your emails, why it depends on strict DMARC, and how to read your BIMI DNS record and catch the usual setup mistakes.
- SPF, DKIM, and DMARC: A Practical Guide to Email Authentication and DeliverabilityHow SPF, DKIM, and DMARC work together to prove your mail is genuine, keep it out of spam, and stop spoofing of your domain. A step-by-step setup guide.
Frequently asked questions
- How do I use the DMARC Generator?
- Pick your policy (p=none, quarantine or reject), optionally set a subdomain policy (sp), add reporting addresses for aggregate (rua) and forensic (ruf) reports, and adjust pct, adkim and aspf as needed. The record builds live in your browser; copy it and add it as a TXT record at _dmarc.yourdomain.com.
- What is a DMARC record?
- DMARC (Domain-based Message Authentication, Reporting and Conformance) is a TXT record at _dmarc that tells receiving mail servers how to handle messages that fail SPF and DKIM alignment. It always starts with v=DMARC1 followed by your policy and reporting options.
- Why does DMARC matter?
- Without DMARC, anyone can spoof your domain in the From address and receivers have no instruction on what to do about it. A DMARC policy lets you reject or quarantine those forgeries and receive reports showing who is sending mail as your domain.
- How do I read the policy I built?
- p=none only monitors and collects reports without affecting delivery, p=quarantine sends failing mail to spam, and p=reject blocks it outright. Start at p=none with a rua address, review the reports, then tighten to quarantine and reject once legitimate senders pass.
- What is a common DMARC mistake to avoid?
- DMARC only acts when SPF or DKIM also align with the From domain, so publishing p=reject before your real senders authenticate correctly can block your own legitimate email. Use pct to roll out enforcement to a fraction of mail first, and confirm alignment before going to 100%.
- What is the fo tag?
- fo (failure reporting options) decides when forensic/failure (ruf) reports are generated, and only matters if you set a ruf address. fo=1 (report if SPF or DKIM fails alignment) is the most useful; fo=0 is the default (report only if both fail); fo=d and fo=s target DKIM or SPF failures specifically. Note that most large mailbox providers do not send forensic reports at all.