DMARC record generator
Answer a few questions and get a valid DMARC record, with every default left out so the record says only what you meant. Nothing is sent anywhere — this page does the work.
Used to build the record name and to spot a reporting address that lives somewhere else.
Publishing your first record? Choose none. It is not a weak choice, it is the only safe one until you have read the reports.
The mailbox that receives the daily XML. Comma-separate for more than one. Leave empty and you get no reports at all.
Omitting sp makes subdomains follow p, which is almost always what you want.
Advanced tags
The current specification's replacement for pct. t=y asks receivers to apply the policy one step weaker than published, so p=reject behaves as quarantine while you watch the reports.
Applies the policy to a share of failing mail while you roll out. The remainder is not exempt — it drops to the next weaker policy. Removed by the current specification, but still honoured by receivers, so it remains usable as a ramp — see what changed.
Few providers send these, and those that do may include message content. Treat the mailbox as sensitive.
Only affects failure reports, so it does nothing without ruf.
Your record
Copied.
Why the record is shorter than you expected
Most generators emit every tag, including the ones set to
their defaults —
adkim=r; aspf=r; fo=0; t=n. That is valid, and it is also
four tags of noise that say nothing. This one omits any tag whose value
is the default, because a record you can read at a glance is a record
you can review a year from now.
There is a sharper argument for it than tidiness. Those same generators
have spent years padding records with pct=100,
rf=afrf and ri=86400 — three tags the
current specification has since
removed outright. Every one of them was noise on the day it was
written, and now it is noise naming a tag that no longer exists.
The one exception worth knowing: leaving out sp is not the
same as setting sp=none. Omitted, subdomains inherit
p; set to none, they are exempt. That
difference is a common way an enforcing domain turns out to be
spoofable through a subdomain.
Where to publish it
Add a TXT record at your DNS host with the name
_dmarc — most panels append your domain automatically, so
typing the full _dmarc.yourdomain.com is how you end up
with _dmarc.yourdomain.com.yourdomain.com and a record no
receiver will ever find. If your host requires the full name, use it;
if the field is pre-filled with your domain, just _dmarc.
Per-provider steps, including the exact field names, are under DMARC setup. Once it has propagated, confirm it resolves with the record checker.
Start at p=none, and mean it
A record is not a policy decision so much as the start of one.
p=none asks providers to report without changing
delivery, which is what lets you discover the sending sources you had
forgotten — the invoicing system, the ticketing tool, the mail relay a
team set up years ago. Going straight to p=reject before
that inventory exists is how legitimate mail disappears.
The route from there is in monitoring to enforcement, and it is driven entirely by the reports.
The record is the easy part
Publishing takes five minutes. Reading the aggregate reports that start arriving — one from every provider, every day, as XML — is the part that decides whether you ever reach enforcement. Across more than a couple of domains it stops being something you do by hand.
That is what DMARC Analyzer is for: it collects the reports, parses them, and shows the sending sources per domain over time. It is free and open source, and self-hosted, so the reports stay on your infrastructure.