DMARC Record Generator
Build a valid DMARC TXT record with the right policy, reporting, and alignment settings. All generation runs in your browser — nothing is sent to our servers.
What is DMARC?
DMARC (Domain-based Message Authentication, Reporting and Conformance) is an email authentication protocol defined in RFC 9989. It builds on SPF and DKIM by adding a policy layer: domain owners publish a DNS TXT record at _dmarc.example.com that tells receiving mail servers what to do when a message fails both SPF and DKIM alignment checks. If your record predates RFC 9989, review what changed from RFC 7489 — this generator omits the deprecated tags.
A DMARC record starts with v=DMARC1 followed by a semicolon-separated list of tags. Only the version tag is strictly required: under RFC 9989, a syntactically valid record without a policy (p=) tag is treated as if it declared p=none. In practice, always set p= explicitly, and add the rua tag, which specifies where to send aggregate reports so you can monitor authentication results.
Organizations typically start with p=none to gather data, then gradually tighten to quarantine and finally reject as they confirm all legitimate senders pass authentication. During rollout, t=y (testing mode) tells receivers a policy is still being evaluated — it replaces the legacy pct percentage rollout from RFC 7489.
DMARC Tag Reference
| Tag | Required | Description |
|---|---|---|
v | Yes | Version. Must be DMARC1 and must be the first tag. |
p | Recommended | Domain policy: none, quarantine, or reject. Absent means p=none. |
sp | No | Subdomain policy. Inherits from p if absent. |
rua | No | Aggregate report URI(s) for daily XML reports. |
ruf | No | Forensic report URI(s) for per-message failure reports. |
adkim | No | DKIM alignment: r (relaxed) or s (strict). |
aspf | No | SPF alignment: r (relaxed) or s (strict). |
t | No | t=y marks the policy as testing mode — the DMARCbis replacement for the historic pct tag. |
np | No | Policy for non-existent subdomains (new in RFC 9989). |
fo | No | Failure reporting options: 0 (all fail), 1 (any fail), d (DKIM), s (SPF). |
pct / rf / ri | Historic | RFC 7489 legacy tags, marked historic in RFC 9989 — DMARCbis receivers ignore them; use t=y instead of pct. |
Read the complete DMARC guide to learn more.
Frequently asked questions
How do I create a DMARC record?
Choose a policy, add your reporting address, and the generator assembles a valid record such as v=DMARC1; p=none; rua=mailto:dmarc@example.com. Publish it as a DNS TXT record at the host name _dmarc on your domain. Everything runs in your browser — nothing is sent to our servers.
What tags can a DMARC record contain?
Per RFC 9989, v=DMARC1 must be the first tag, and p sets the policy (none, quarantine, or reject). Optional tags include rua and ruf (report destinations), sp (subdomain policy), adkim and aspf (alignment modes), and fo (failure-report options). The legacy pct, rf, and ri tags from RFC 7489 are marked historic in DMARCbis. RFC 9989 also adds three tags: np (policy for non-existent subdomains), t (t=y marks the policy as being tested and asks receivers to apply one level below it, replacing the removed pct), and psd (flags a record published for a Public Suffix Domain).
What DMARC policy should I start with?
Start with p=none plus a rua= address. It changes nothing about delivery but makes receivers send you aggregate reports listing every source that sends as your domain. Once the reports confirm your legitimate senders pass alignment, move to p=quarantine and finally p=reject.
Where do I publish the DMARC record?
As a DNS TXT record at _dmarc.<yourdomain> — in most DNS dashboards that means host/name _dmarc and the generated string as the value. Publish exactly one: per RFC 9989, if multiple DMARC records are returned for the same name, receivers discard them all.
What is the difference between rua and ruf?
rua= receives aggregate reports (RFC 9990): XML summaries of authentication results across all sending sources, typically sent daily. ruf= receives failure reports (RFC 9991): per-message reports generated when an individual message fails. Start with rua — many receivers never send ruf reports at all.
Do I need SPF and DKIM before DMARC?
You need at least one of them aligned with your From domain — DMARC passes only when SPF or DKIM passes with an aligned identifier. Deploy DKIM and SPF first, then publish DMARC at p=none and use aggregate reports to verify alignment before enforcing.
Get the full picture with DMARCguard
Continuous monitoring, aggregate report parsing, and actionable insights for all your email authentication protocols.
Start Free