DMARC Record Generator

DMARC (Domain-based Message Authentication, Reporting & Conformance) is an email authentication policy that builds on top of SPF and DKIM. It tells receiving servers how to handle messages that fail authentication (do nothing, quarantine, or reject) and lets you collect reports about who is sending mail using your domain. This generator lets you pick the policy (p), subdomain policy (sp), application percentage (pct), aggregate/forensic report addresses (rua/ruf), and alignment modes (adkim/aspf) to build a valid DMARC TXT record instantly.

Publish the generated value as a TXT record on the _dmarc subdomain of your domain. When rolling DMARC out, start with p=none to monitor, confirm legitimate mail passes via the reports, then gradually tighten to quarantine and reject. Everything runs in your browser and no input is sent anywhere.

DMARC tags at a glance

A DMARC record is a set of tag=value pairs separated by semicolons. The most common tags are:

• v: Version. Always DMARC1 and must come first.
• p: Domain policy. none (monitor only) / quarantine (send to spam) / reject (refuse delivery).
• sp: Subdomain policy. If omitted, it inherits the value of p.
• pct: Percentage of mail the policy applies to (0–100). For example pct=25 applies quarantine/reject to only 25% of messages for a gradual rollout.
• rua: Address for aggregate reports, published as a mailto: URI.
• ruf: Address for forensic (failure) reports. Many receivers no longer support it due to privacy concerns.
• adkim / aspf: DKIM/SPF alignment mode. r (relaxed, default) or s (strict).

How to publish

1. Set the DNS host name to _dmarc.example.com (for the root domain). For a subdomain use _dmarc.sub.example.com.
2. Choose record type TXT.
3. Paste the value this tool generates and save.
4. After propagation, verify with a lookup such as dig TXT _dmarc.example.com.

A staged rollout strategy

Jumping straight to p=reject risks blocking legitimate mail. The recommended order is none → quarantine → reject. When moving to quarantine or reject, start pct at a low value and raise it toward 100 while watching the reports. The key prerequisite is making sure SPF and DKIM are aligned across every sending source first. After publishing the record, confirm it took effect with DMARC Record Lookup.

Reading a real record

Below is a typical record for a domain mid-transition to quarantine. Here is how each tag is interpreted, one by one.

v=DMARC1; p=quarantine; sp=reject; pct=50; rua=mailto:dmarc@example.com; ruf=mailto:forensic@example.com; adkim=s; aspf=r; fo=1

• p=quarantine + pct=50: only half of failing mail is sent to spam; the other half is delivered (a gradual rollout).
• sp=reject: the root domain quarantines, but subdomains are treated more strictly and rejected — handy for blocking spoofing of unused subdomains.
• adkim=s: the DKIM signing domain must match the From domain exactly to count as aligned (a subdomain mismatch fails).
• fo=1: generate a failure report if either SPF or DKIM fails alignment (the default 0 only fires when both fail).

Lesser-known tags reference

Tags that the generator may not expose, or that hide behind defaults, give you finer control over reporting.

Common pitfall

• Missing the external authorization record when reporting to another domain: if the mailto domain in rua/ruf differs from your domain (e.g. the record is for example.com but reports go to reports.vendor.com), the receiving side must publish a separate TXT record at example.com._report._dmarc.reports.vendor.com containing v=DMARC1. Without it, external reports are silently discarded.
• pct only applies to reject/quarantine: writing p=none; pct=50 does nothing meaningful in the monitoring stage — pct only throttles the share of mail that is quarantined or rejected.