Free DMARC record generator
Build a DMARC record for your domain one step at a time: start by monitoring, then enforce once your reports show your real senders pass. Nothing you enter is saved.
Rolling out DMARC
Monitor first. Enforce with evidence.
- 01
Start at p=none
Publish the record with a reporting address. Delivery does not change.
- 02
Read the reports
Find every service sending as your domain. Fix SPF or DKIM for the ones you use.
- 03
Move to quarantine
Once your real senders pass, failing email goes to spam instead of the inbox.
- 04
Finish at reject
Failing email is refused, so others cannot send as your domain.
Reading a DMARC record
What each tag means.
- v=DMARC1
- Marks the TXT record as DMARC. It must come first, followed by p.
- p=
- The policy for email that fails: none, quarantine or reject.
- rua=
- Where receivers send daily aggregate reports, as mailto: addresses.
- sp=
- A different policy for subdomains. Without it, subdomains follow p.
- adkim= / aspf=
- Alignment: r (relaxed, the default) accepts subdomains of your domain, s (strict) requires an exact match.
After publishing
The reports are the point. They arrive as XML.
Every receiver sends its own report, every day, as a compressed XML file. DemiSignal gives you a private reporting address, reads the reports and shows which services send email as your domain and whether they pass, so you know when it is safe to enforce.
See plans and pricing →Questions, answered
Before you publish.
Which policy should I start with?
p=none with a reporting address. It changes nothing for delivery and shows you every service that sends email as your domain. When your real senders pass SPF or DKIM, move to quarantine, then reject.
What does the rua tag do?
It is the address where receivers such as Google, Microsoft and Yahoo send daily aggregate reports: which servers sent email as your domain and whether SPF and DKIM passed. The reports are XML files, so most people use a service to read them.
Can reports go to an address on another domain?
Yes, but that domain must publish a TXT record authorizing it, at yourdomain._report._dmarc.otherdomain with the value v=DMARC1. Without it, receivers do not send the reports. Reporting services set this up for you.
What do adkim and aspf change?
They set alignment. Relaxed, the default, accepts a subdomain of your domain, for example mail.example.com for example.com. Strict requires an exact match. Most domains keep relaxed.
Does a DMARC record affect email I receive?
No. It only tells other mail servers how to treat email that claims to come from your domain.
Do Google, Yahoo and Microsoft require DMARC?
They require bulk senders to publish a DMARC record, and p=none meets the minimum. An enforced policy protects your domain from being used by others, whatever your volume.
Related tools