What does a DMARC generator do?
A DMARC generator writes the DNS TXT record that tells receiving mail servers how to treat messages that fail authentication for your domain and where to send reports. You pick the policy, reporting address and alignment options, and it outputs the exact record value and the host name to publish it under.
How to publish the record
- Check that SPF and DKIM already work for the mail you send. DMARC builds on them.
- Choose
noneas the policy if this is the domain's first DMARC record. - Enter an address for aggregate reports — a mailbox you will actually read, or a DMARC reporting service.
- Copy the record and create a TXT record at your DNS host with the name
_dmarc. - Confirm it with the DMARC checker.
_dmarc.example.com. TXT "v=DMARC1; p=none; rua=mailto:dmarc@example.com"What each option means
| Option | Tag | Guidance |
|---|---|---|
| Policy | p | none to monitor, quarantine to send failures to spam, reject to block them. |
| Subdomain policy | sp | Leave it the same as the main policy unless a subdomain needs looser handling. |
| Aggregate reports | rua | Daily XML summaries. Always set this — it is how you see who sends as you. |
| Failure reports | ruf | Per-message samples. Optional, and many receivers do not send them. |
| Percentage | pct | Apply the policy to part of failing mail during rollout. Leave at 100 otherwise. |
| DKIM / SPF alignment | adkim / aspf | Relaxed lets mail.example.com align with example.com. Strict needs an exact match. |
The generator leaves out any tag that is at its default, as the standard (RFC 7489) intends. A shorter record is easier to read and has less to go wrong.
Which policy should you start with?
Start at p=none. It changes nothing about how your mail is delivered, and within a day or two receivers begin sending reports that list every server sending mail with your domain in the From address.
Those reports nearly always reveal a sender nobody remembered — a billing system, a form plugin, an old newsletter tool. Fix each one so it passes SPF or DKIM with alignment, then move to quarantine, then to reject. Skipping straight to reject is the most common way to lose legitimate mail.
For a domain that sends no email at all, there is nothing to discover. Publish the strictest policy immediately:
_dmarc.example.com. TXT "v=DMARC1; p=reject"Sending reports to another domain
If the report address is on a different domain from the one being protected, that other domain must publish a small record saying it agrees to receive them. Without it, receivers discard the reports.
example.com._report._dmarc.reports-provider.com. TXT "v=DMARC1"DMARC reporting services publish this for all their customers. You only need to add it yourself when sending reports to a second domain of your own.
After you publish
- Reports arrive as XML attachments, usually zipped, once a day from each large receiver. They are hard to read raw; a reporting service or a parser turns them into a table of sending sources.
- Look at the source IPs that fail. Ones you recognize need their SPF or DKIM fixed. Ones you do not recognize are either forwarding or someone spoofing your domain.
- Edit the one record to change policy. Never add a second DMARC record for a new policy or a new report address — two records cancel each other out.
Private by design
This generator runs entirely in your browser. The domain and email addresses you enter are never sent to our servers or stored — the record is assembled locally from the form.