Skip to main content
DMARC

DMARC Record Generator

Build a valid DMARC TXT record with the right policy, reporting, and alignment settings. All generation runs in your browser -- nothing is sent to our servers.

What is DMARC?

DMARC (Domain-based Message Authentication, Reporting and Conformance) is an email authentication protocol defined in RFC 7489. It builds on SPF and DKIM by adding a policy layer: domain owners publish a DNS TXT record at _dmarc.example.com that tells receiving mail servers what to do when a message fails both SPF and DKIM alignment checks.

A DMARC record starts with v=DMARC1 followed by a semicolon-separated list of tags. The two required elements are the version tag and the policy (p=). Everything else is optional but strongly recommended -- especially the rua tag, which specifies where to send aggregate reports so you can monitor authentication results.

Organizations typically start with p=none to gather data, then gradually tighten to quarantine and finally reject as they confirm all legitimate senders pass authentication. The pct tag lets you apply the policy to a percentage of failing messages during rollout.

DMARC Tag Reference

TagRequiredDescription
vYesVersion. Must be DMARC1 and must be the first tag.
pYesDomain policy: none, quarantine, or reject.
spNoSubdomain policy. Inherits from p if absent.
ruaNoAggregate report URI(s) for daily XML reports.
rufNoForensic report URI(s) for per-message failure reports.
adkimNoDKIM alignment: r (relaxed) or s (strict).
aspfNoSPF alignment: r (relaxed) or s (strict).
pctNoPercentage of failing messages the policy applies to (0-100).
foNoFailure reporting options: 0 (all fail), 1 (any fail), d (DKIM), s (SPF).
riNoRequested aggregate report interval in seconds (default 86400).

Get the full picture with DMARCguard

Continuous monitoring, aggregate report parsing, and actionable insights for all your email authentication protocols.

Start Free