Free DMARC record generator.
Answer two questions and copy out one valid DMARC record. Start at monitoring, watch what the reports turn up, then tighten. The reference below covers what each optional tag adds and why almost nobody should publish reject on day one.
Privacy: this tool runs entirely in your browser. Nothing you type leaves this page, nothing is stored, and nothing is sent to GrowthPal.
Publishing DMARC, at a glance
| Item | Value |
|---|---|
| Where it goes | A TXT record with the host set to _dmarc on your domain |
| Smallest useful record | v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com |
| Prerequisite | SPF or DKIM already passing and aligned. DMARC enforces, it does not authenticate |
| Safe starting policy | p=none. It changes nothing about delivery and starts the reports |
| Bulk sender requirement | Gmail and Yahoo have required a DMARC record from senders above 5,000 messages a day to their users since February 2024 |
What does publishing DMARC actually change?
Publishing DMARC changes two things: receivers start telling you who is sending as your domain, and, once you ask them to, they start acting on failures.
Those two arrive in that order for a reason. Almost every domain has a sender nobody remembers configuring, and the reports are the only way to find it before a policy starts blocking it. Publishing p=reject on day one does not make you secure on day one, it makes your invoices disappear on day one.
The second thing worth understanding is that DMARC does not authenticate anything itself. It reads the results SPF and DKIM already produced and adds one requirement they lack: the authenticated domain must match the domain your recipient sees. If neither SPF nor DKIM aligns, DMARC fails, no matter how correct each record looks in isolation.
How to read the record this builds
The generator returns a single record plus a note on each choice you made.
The placement note is the one that catches people: the host field is _dmarc, not @ and not the full _dmarc.yourdomain.com unless your DNS provider expects fully qualified names. Getting this wrong publishes a record nobody will ever read.
The policy note reflects what you chose. p=none comes back as a starting point rather than a destination, with the two to four week window before tightening. An enforcing policy comes back with a warning attached, because reject and quarantine punish your own misconfigured senders first.
The reporting note appears when you leave the report address empty. The record still works without one, and it is still close to useless: you have taken on the policy without the visibility that makes it safe to change.
Which tags to set, and what each one buys you
| Tag | Set it when | Leave it alone when |
|---|---|---|
p | Always. It is required and the record is ignored without it. | Never. |
rua | Always. Without reports you are enforcing blind. | Never, really. |
pct | Stepping into quarantine or reject on a busy domain, so only a share of failures is affected. | On a dedicated sending domain with a short, known sender list. |
sp | Subdomains need a different policy from the parent, usually stricter. | You are happy for subdomains to inherit, which is the default. |
adkim / aspf | You have a specific reason to demand exact-match alignment. | Almost always. Strict breaks the moment a provider signs with its own subdomain. |
ruf | Rarely. Support is patchy and the reports carry recipient data. | By default. The aggregate reports answer most questions. |
What the reports will tell you
| What you see | What it means | What to do |
|---|---|---|
| Your own platform, passing and aligned | Working as intended. | Nothing. |
| A service you recognize, failing | A legitimate sender that was never configured for your domain. | Add it to SPF, or have it sign with DKIM as your domain. |
| A service you do not recognize, failing | Usually a forgotten tool. Occasionally someone spoofing you. | Identify it before tightening the policy. |
| Passing SPF but failing alignment | The provider is sending as its own envelope domain. | Configure a custom return path, or rely on aligned DKIM instead. |
| Volume from a country you do not operate in | Often forwarding rather than abuse. | Check whether DKIM still aligns before assuming the worst. |
How to roll DMARC out without blocking your own mail
- Confirm SPF and DKIM first. DMARC enforces results it does not produce. If neither is aligned today, every policy above none will fail your own mail.
- Publish p=none with a report address. Host
_dmarc, TXT, value exactly as generated. v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com - Collect two to four weeks of reports. They arrive daily as compressed XML. Point them at a mailbox you use for nothing else, or a parser.
- Resolve every legitimate failing sender. This is the actual work, and it is the whole reason for the waiting period.
- Move to quarantine. Use
pctto ramp if the domain carries significant mail. - Move to reject once quarantine is quiet. Then keep reading the reports. New senders appear whenever someone signs up for a new tool.
Common questions about publishing DMARC
How long should I stay on p=none before tightening?
Long enough to see a few weeks of reports containing only senders you recognize, usually two to four. The point of the wait is catching the forgotten sender, an old CRM or a billing tool, before quarantine starts silently holding its mail.
What is the pct tag and should I use it?
pct tells receivers to apply your policy to only a share of failing mail, so pct=25 with quarantine holds a quarter of failures and delivers the rest. It is a way to step into a stricter policy gradually. Useful on a busy primary domain, unnecessary on a dedicated sending domain with a short sender list.
Can several domains share one DMARC record?
No, each domain publishes its own at _dmarc.thatdomain. They can all report to the same address, but if that address is on a different domain, the receiving domain has to publish an authorization record or receivers will drop the reports.
Does a stricter policy improve deliverability?
It removes a reason to distrust you, which is not the same as earning trust. reject stops others spoofing your domain and clears the bulk sender bar. Placement still comes from warmup, list quality and whether people reply.
Do I need DMARC on my cold email sending domains too?
Yes, and it is easier there than on your primary. A dedicated sending domain has one or two known senders, so there is no archaeology to do and no forgotten billing tool to break. Publish all three records before the first warmup send rather than retrofitting them later.
What happens if I publish DMARC without SPF or DKIM?
The record is valid and every message fails it. At p=none that costs you nothing and produces useful reports, which is a legitimate way to start. At quarantine or reject it means your own mail stops arriving, which is why the order in the steps above is not optional.
Tools check the plumbing. The message is what your market answers. Get your TAM mapped, your ICP broken down and 5 angles written for your buyers, free.