DMARC Record Generator

Build a valid DMARC record for your domain. Set your policy, configure reporting, and generate a ready-to-publish TXT record.

Policy (p=)
Override the policy for subdomains if they differ from the root domain.
Override the policy for subdomains that do not exist (NXDOMAIN). Added in RFC 9989.
Where to send daily XML aggregate reports. Strongly recommended.
Where to send per-message forensic reports (many providers no longer send these).
Alignment
DKIM alignment (adkim=)
SPF alignment (aspf=)
Failure reporting options (fo=)
Adds t=y - policy is recorded but not enforced on any mail. Added in RFC 9989.
Receiver compatibility: receivers that do not yet support RFC 9989 will ignore t=y and enforce your policy normally. t=y is not a universal safety net - use p=none if you need a monitoring mode that works on all receivers.
These tags were valid in RFC 7489 but removed in RFC 9989. Use only if you need compatibility with systems that have not yet adopted the new spec.
Percentage of messages to apply the policy to. Replaced by t=y in RFC 9989 for test mode. Omitted if blank.
Your DMARC Record
TXT record name: _dmarc.yourdomain.com
v=DMARC1; p=none
Publish this as a TXT record at _dmarc.yourdomain.com.

How to use the DMARC Generator

Start with p=none to begin monitoring. This lets you collect aggregate reports without affecting mail delivery. Once you're confident that legitimate mail passes SPF and DKIM, escalate to p=quarantine, then p=reject.

Set up the rua= address to receive daily aggregate reports. These reports tell you which servers are sending mail claiming to be from your domain, and whether that mail is passing authentication checks. Tools like Google Postmaster Tools, Valimail, and DMARC Analyzer can parse these reports for you.

Relaxed alignment (the default) allows subdomains to pass - e.g. mail from mail.example.com passes for example.com. Strict alignment requires an exact domain match. Use relaxed unless you have a specific reason to require strict.

After publishing, use the DMARC Checker to verify your record is correctly formatted and reachable.

RFC 9989 support

This generator implements the latest DMARC specification, RFC 9989 (published 2025), which supersedes the original RFC 7489. Options marked New in RFC 9989 are part of the updated spec.

Adoption across email providers and receivers is ongoing - not all systems support the new options yet. Per the DMARC specification, receivers silently ignore any tag they do not recognise, so including new tags in your record is safe: older receivers will simply skip them. The one important exception is t=y (test mode): a receiver that does not understand it will ignore it and enforce your policy, not suppress it - see the warning above.

The legacy pct=, rf=, and ri= tags from RFC 7489 were removed in RFC 9989. They are still widely honoured by existing deployments, but should not be used in new records.