Create a correct DMARC record for your domain without memorizing RFC 9989 syntax. Pick a policy, add report addresses, and copy a ready-to-publish TXT record.
Answer a few questions about your domain and reporting, and get a ready-to-publish TXT record that follows the current DMARC specification (RFC 9989).
The domain you send email from, e.g. example.com. The record is published at _dmarc.yourdomain.
Applies to subdomains such as mail.example.com.
Policy for subdomains that do not exist in DNS (new in RFC 9989).
psd tells receivers whether this domain is itself a public suffix — an entry on the Public Suffix List such as co.uk or com.au. Setting psd=y for an ordinary domain makes the record wrong and changes how subdomains are treated. Almost every domain should leave this unset.
Everything runs in your browser. The domain and report addresses you enter are never sent to a server or stored.
The domain you send email from. It sets the DNS host (_dmarc.yourdomain) and is used to detect report addresses that live outside your domain.
Decide what receivers do with failing mail: monitor with p=none first, then quarantine or reject once your reports are clean. Optionally set different policies for subdomains and non-existent subdomains.
List mailboxes for aggregate reports so you can see every sender using your domain. Failure reports are optional and come with privacy trade-offs the tool explains.
The record is built deterministically in canonical order and checked against the same RFC 9989 parser our checker tool uses, with plain-language notes for every tag.
Add the value to your DNS provider at the host shown. If a DMARC record already exists, replace it — a domain must publish exactly one.
Read reports for a couple of weeks, fix failing legitimate senders, then move from p=none to quarantine and reject. Verify the published record with our DMARC Record Checker.
Look up a live domain and validate its published DMARC record, policy inheritance, and report authorization against RFC 9989.
Open toolBuild the SPF record that lists which servers may send mail as your domain — DMARC builds on it.
Open toolCreate a DKIM key pair and DNS record so your outgoing mail carries a cryptographic signature.
Open toolOnce DMARC is enforced, publish a BIMI record to make your logo eligible for display in supporting inboxes.
Open toolA DMARC record is a single TXT record published at _dmarc.yourdomain in DNS. It tells receiving mail servers what to do with messages that fail SPF and DKIM alignment checks, and where to send reports about mail claiming to be from your domain.
Start with p=none plus an aggregate report (rua) address. This monitors mail without affecting delivery, so you can see every sender using your domain. Once reports show all legitimate mail passes SPF or DKIM alignment, move to p=quarantine and then p=reject. Never assume p=none blocks spoofed mail — it only watches.
The pct tag was removed by RFC 9989, the current DMARC specification published in May 2026, so this generator deliberately does not offer it. Enforcement now applies to all mail; the safe rollout path is p=none monitoring followed by full quarantine or reject, not a percentage of messages.
Aggregate reports are daily XML summaries from receivers showing which servers sent mail as your domain and whether it passed. Failure reports are per-message forensic reports; they can contain message metadata and sometimes content, so point them at a mailbox you control and expect some receivers to never send them.
Yes, but the destination domain must authorize it by publishing a TXT record named yourdomain._report._dmarc.their-domain with the value v=DMARC1. The generator shows the exact authorization record when you use an external address. Even then, the destination operator decides whether to accept and send reports for you.
No. DMARC tells receivers how to handle mail that fails authentication; it protects your domain from direct spoofing and gives you visibility through reports. Inbox placement still depends on SPF and DKIM being correctly configured, sender reputation, engagement, and content.
Automate Sales Outreach & Get Booked!
Start Free Trial(14 Day Free Trial, No CC Required)