How to Use the DMARC Record Generator
Generate a DMARC record by entering your domain, choosing a policy and report addresses, then copying the validated TXT value into your DNS.
- Enter your domain, such as example.com, without _dmarc or https://.
- Choose the policy, an optional subdomain policy and the addresses that should receive aggregate (rua) and failure (ruf) reports.
- Select Generate record to build the TXT value and validate it.
- Copy the host name and value into your DNS provider, following the steps shown for Cloudflare, GoDaddy, Namecheap or Route 53.
- Once the change has propagated, open the DMARC Checker to confirm the published record.
Create a DMARC Record
To create a DMARC record, publish one TXT record at _dmarc.yourdomain that starts with v=DMARC1 and states a policy. This generator writes every tag for you and explains what each one does.
DMARC Record Syntax
A DMARC record is a list of tag=value pairs separated by semicolons, and v=DMARC1 must come first. The p tag sets the policy, sp and np cover subdomains and non-existent subdomains, rua and ruf take mailto addresses, and adkim and aspf choose relaxed or strict alignment. The generator leaves out pct when it is 100, because RFC 9989 marks that tag as historic.
DMARC Record Example
A typical first record is v=DMARC1; p=none; rua=mailto:dmarc@example.com; adkim=r; aspf=r. It changes nothing for delivery but asks receivers to send daily aggregate reports to the rua address. Those reports list every server that sent mail as your domain and whether it passed SPF and DKIM.
How to Add a DMARC Record
Add a TXT record named _dmarc whose value is the generated text. Cloudflare, GoDaddy and Namecheap append your domain to the name, so you enter only _dmarc there. The Route 53 console also takes _dmarc in the record name box, but the value must be wrapped in double quotes. The new record usually becomes visible within its TTL, often minutes to an hour.
Recommended DMARC Record
Start with p=none and a rua address, then read the reports for two to four weeks. When every legitimate service passes in alignment, move to p=quarantine and later to p=reject, which gives the strongest protection against spoofing. The testing flag t=y can soften each step while you watch the reports.
DMARC Quarantine vs Reject
Quarantine asks receivers to deliver failing mail to the spam folder, while reject asks them to refuse it outright.
| Policy | What receivers are asked to do | When to use it |
|---|---|---|
| p=none | Deliver failing mail as usual and send reports | The first weeks, while you find every sending service |
| p=quarantine | Treat failing mail as suspicious, usually the spam folder | After the reports show your own senders pass |
| p=reject | Refuse failing mail during the SMTP transaction | When the reports are clean and you want full spoofing protection |
Frequently Asked Questions
What Is a DMARC Record?
It is a DNS TXT record at _dmarc.yourdomain that tells receiving mail servers what to do with messages that fail SPF and DKIM alignment. It also says where to send reports about mail that uses your domain in the From address.
Can You Have More Than One DMARC Record?
No. A receiver that finds two v=DMARC1 records at the same name ignores DMARC for that domain. Edit the existing record instead of adding a second one.
Where Do I Add a DMARC Record?
Add it at the DNS host of your domain, which is the service that runs your nameservers and not always the place where you bought the domain. The record type is TXT and the name is _dmarc. A subdomain such as mail.example.com can have its own record at _dmarc.mail.example.com.
Will DMARC Work Without DKIM?
Yes, a message passes DMARC when either SPF or DKIM passes and aligns with the From domain. SPF breaks when mail is forwarded, though, so forwarded messages fail without a DKIM signature. Set up DKIM before you move to quarantine or reject.
Related Email Tools
Continue with the guide What Is DMARC. Policies, alignment and reports explained.