What does a DMARC record actually do?

It tells receiving mail servers what to do with messages that claim to be from your domain but fail both SPF and DKIM alignment, and where to send reports about them. Without it, receivers make that decision on their own.

Should I start with p=none, quarantine or reject?

Start with none. It changes nothing about delivery but turns on aggregate reporting, which is how you discover every system legitimately sending as your domain. Move to quarantine and then reject only once those all pass alignment.

What is the difference between relaxed and strict DMARC alignment?

Relaxed alignment accepts a subdomain match, so mail from bounce.example.com aligns with example.com. Strict requires an exact match. Relaxed is the default and is right for most organisations, since bulk senders commonly use subdomains.

Where do I publish a DMARC record?

As a TXT record on the hostname _dmarc followed by your domain — _dmarc.example.com for example.com. Some DNS panels want just the _dmarc part in the name field and add the domain themselves.

Does the DMARC Record Generator query my DNS?

No. It builds and validates the record text on your device without making any DNS query, so nothing about your domain is sent anywhere.

DMARC Record Generator

Build a valid DMARC TXT record with policy, reporting and alignment — or paste an existing one and have it checked.

The DMARC Record Generator runs entirely in your browser. Your domain and report addresses are used only to build and check the record on your device.

Open the CSP Header Generator

About DMARC Record Generator

DMARC Record Generator builds the single DNS TXT record that tells receiving mail servers what to do with messages claiming to be from your domain that fail SPF and DKIM alignment. The record is published at _dmarc.yourdomain and is a semicolon-separated list of tag=value pairs with strict ordering — the version tag first, the policy tag second. Optional tags that match the DMARC defaults are left out so the record stays comfortably inside the 255-character TXT string limit. A second mode goes the other way: paste a record you already publish and every tag is parsed and checked, with missing mailto: prefixes, out-of-range percentages and misordered tags reported individually.

Features

Builds the record with tags in the order the specification requires
Policy, subdomain policy, percentage and alignment for SPF and DKIM
Aggregate (rua) and forensic (ruf) reporting addresses, normalised to mailto:
Omits optional tags that match the DMARC default to keep the record short
Emits both the TXT value and a ready-to-paste zone file line
Checker mode validates an existing record tag by tag
Distinguishes errors that break the policy from warnings worth knowing
Shows the exact hostname the record must be published at

How to use the DMARC Record Generator

Enter your domain to see the hostname the record belongs at
Choose a policy — start at none while you are still collecting reports
Add an aggregate report address so you actually receive the data
Copy the TXT value into your DNS provider, or switch to check an existing record

Example

Input

domain example.com, policy none, rua dmarc@example.com

Output

v=DMARC1; p=none; rua=mailto:dmarc@example.com

Published as a TXT record at _dmarc.example.com — the monitoring-only starting point for any rollout.

Common errors & troubleshooting

The checker says a report address is not usable. — DMARC report destinations are URIs, not bare addresses, so they need the mailto: prefix. The generator adds it automatically; a hand-written record often does not have it.
The checker complains that p= must come immediately after v=DMARC1. — The specification fixes the order of the first two tags. Move the policy tag directly after the version tag — everything after those two can appear in any order.
A warning says fo has no effect. — The fo tag controls when failure reports are generated, so it does nothing without a ruf address to send them to. Add one or drop the tag.
Mail from a legitimate sender started bouncing after publishing. — That is what a reject policy does to a sender you have not authorised yet. Move back to p=none, read the aggregate reports to find every system that sends as your domain, and tighten again once they all pass.

Frequently asked questions

What does a DMARC record actually do?: It tells receiving mail servers what to do with messages that claim to be from your domain but fail both SPF and DKIM alignment, and where to send reports about them. Without it, receivers make that decision on their own.
Should I start with p=none, quarantine or reject?: Start with none. It changes nothing about delivery but turns on aggregate reporting, which is how you discover every system legitimately sending as your domain. Move to quarantine and then reject only once those all pass alignment.
What is the difference between relaxed and strict DMARC alignment?: Relaxed alignment accepts a subdomain match, so mail from bounce.example.com aligns with example.com. Strict requires an exact match. Relaxed is the default and is right for most organisations, since bulk senders commonly use subdomains.
Where do I publish a DMARC record?: As a TXT record on the hostname _dmarc followed by your domain — _dmarc.example.com for example.com. Some DNS panels want just the _dmarc part in the name field and add the domain themselves.
Does the DMARC Record Generator query my DNS?: No. It builds and validates the record text on your device without making any DNS query, so nothing about your domain is sent anywhere.

Related tools

CSP Header Generator — Build a Content-Security-Policy header from directive toggles, with report-only and copy output.
robots.txt Generator — Visually build a robots.txt with user-agent rules, allow/disallow paths, crawl-delay and sitemaps.
XML Sitemap Generator — Turn a list of URLs into a standards-compliant sitemap.xml with optional lastmod, changefreq and priority.
.htaccess Generator — Toggle and configure common Apache .htaccess snippets with live output.
Nginx Config Generator — Build an nginx server block (static, reverse proxy, SSL, gzip, caching) from simple toggles.
CIDR / Subnet Calculator — Calculate network, broadcast, host range and mask from a CIDR block.