Free DMARC Record Generator
Build a correct DMARC TXT record in seconds. Pick a policy, add a reporting address, and copy the record into your DNS — with every tag explained in plain English. No signup required.
Your DMARC record
_dmarc
TXT
v=DMARC1; p=none;
Add this as a TXT record at the host shown above in your DNS provider. Changes usually propagate within an hour; aggregate reports start arriving within 1–3 days.
Generated your record? Now watch what it reports.
A DMARC record only helps if someone reads the reports. Create a free account and we'll email you a weekly plain-English verdict for your domain — what passed, what failed, and what to fix.
What each tag means
A DMARC record is a list of tag=value pairs published as a TXT record at _dmarc.yourdomain.com. v=DMARC1 identifies the record and must come first. p tells receivers what to do with mail that fails DMARC: none only monitors (start here), quarantine sends failures to spam, and reject blocks them outright. sp optionally sets a different policy for subdomains. pct applies the policy to only a percentage of mail, useful for a gradual rollout to quarantine or reject. rua is the mailbox that receives aggregate reports — without it, you're flying blind. adkim and aspf control how strictly the DKIM signature domain and SPF domain must match your From domain; relaxed (the default) is right for almost everyone.
Get weekly DMARC monitoring →What the record you are building means
This generator writes one DNS TXT record for _dmarc.<yourdomain>. Every DMARC record starts with v=DMARC1 and then sets:
p=— your policy:none(just watch),quarantine(send failing mail to spam) orreject(block it).rua=— the address that receives the daily aggregate reports. Without it you are flying blind.pct=— the percentage of mail the policy applies to, for a gradual rollout.sp=— a separate policy for subdomains, if you want one.adkim=/aspf=— how strictly DKIM and SPF must align.
Start at p=none, then tighten
Do not jump straight to reject. Publish p=none with a rua= address first: that changes nothing about delivery but starts the reports flowing, so you can see every system sending as you. Once the reports show only your legitimate senders passing, move to p=quarantine, then to p=reject. Each step is reversible. The full path is in none, quarantine, reject.
Where the record goes
Add it as a TXT record with the host/name _dmarc (your DNS provider appends the domain). Copy the value exactly — quoting mistakes are the usual cause of a record that does not resolve. Provider-specific steps: Cloudflare and GoDaddy.
About forensic (ruf) reports
This generator does not add a ruf= tag, and that is deliberate: forensic reports contain message-level detail, most providers no longer send them, and aggregate reports tell you what you need. Stick with rua.
After you publish
Publishing is the start, not the end — DMARC is something you watch. Confirm the record with the DMARC checker, then let PlainDMARC read the reports for you and send a weekly plain-English verdict.
Common questions
What policy should I start with?
p=none with a rua= address. It changes nothing about delivery and starts the reports flowing so you can see who sends as you.
What is the rua tag?
The address that receives the daily aggregate reports. It is what makes DMARC useful — without it you are flying blind.
Do I need forensic (ruf) reports?
No. Most providers no longer send them, and aggregate reports tell you what you need. This generator does not add a ruf tag.
A one-off check is a snapshot — DMARC needs watching
PlainDMARC monitors your domains continuously and sends a weekly plain-English verdict per domain — what passed, what failed, and what to fix.