BYTETOOLS

DMARC Record Generator

Generate a DMARC TXT record with policy, subdomain policy, pct, rua/ruf reporting and alignment options — each tag explained in plain English. 100% in-browser.

TXT record for _dmarc.example.com

v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com

Publish as a TXT record with host name _dmarc.example.com. Nothing is looked up or sent from this page.

What each tag means

  • v=DMARC1 — Version tag — must come first.
  • p=none — Policy for mail failing DMARC: monitor only, deliver normally.
  • rua=… — Where receivers send daily aggregate (XML summary) reports.

What is the DMARC Record Generator?

The DMARC Record Generator builds the TXT value for your _dmarc host from guided choices: the policy (none, quarantine or reject), an optional separate subdomain policy, the percentage rollout tag, aggregate and forensic report addresses, and DKIM/SPF alignment strictness — validating report addresses as you type.

  • Builds a valid v=DMARC1 value with correct tag ordering
  • Policy, subdomain policy, pct rollout and fo failure options
  • Validates rua/ruf mailto addresses before adding them
  • Plain-English explanation for every tag in your record
  • Warns about p=none with no reporting address
  • 100% client-side — nothing queried, nothing uploaded

How to use the DMARC Record Generator

  1. 1

    Enter your domain and choose the policy: start with none for monitoring.

  2. 2

    Add an aggregate report address (rua) so you receive daily XML summaries.

  3. 3

    Optionally set a subdomain policy, rollout percentage and alignment strictness.

  4. 4

    Copy the TXT value and publish it at the _dmarc host name shown.

  5. 5

    After a few weeks of clean reports, tighten the policy toward quarantine, then reject.

About the DMARC Record Generator

The DMARC Record Generator builds the TXT value for your _dmarc host from guided choices: the policy (none, quarantine or reject), an optional separate subdomain policy, the percentage rollout tag, aggregate and forensic report addresses, and DKIM/SPF alignment strictness — validating report addresses as you type.

Alongside the finished record you get a plain-English explanation of every tag it contains, so you understand exactly what you are publishing. The tool also flags the classic mistake of monitoring with p=none but no rua address, which reports nothing and protects nothing.

DMARC is what actually stops spoofing of the From address your recipients see, building on SPF and DKIM. Everything here runs 100% locally in your browser — no DNS queries, no data sent anywhere.

Frequently asked questions

What is a DMARC record?

DMARC is a TXT record at _dmarc.yourdomain that tells receiving mail servers what to do when a message fails SPF and DKIM alignment — deliver, quarantine or reject — and where to send reports about it. It is the policy layer that makes SPF and DKIM actually protect your visible From address.

What is the difference between p=none, quarantine and reject?

p=none monitors only: failing mail is delivered normally but you receive reports. p=quarantine asks receivers to treat failures as suspicious, typically sending them to spam. p=reject asks receivers to refuse them outright. The standard rollout is none → quarantine → reject as your reports come back clean.

What are DMARC rua reports and do I need them?

rua addresses receive daily aggregate XML reports showing which IPs sent mail as your domain and whether it passed. They are the whole point of the monitoring phase — without a rua address, p=none does literally nothing. Expect real volume on a busy domain; a dedicated mailbox or report-processing service helps.

Do I need SPF and DKIM before DMARC?

Yes — at least one of them, and ideally both. DMARC passes only when SPF or DKIM passes and the domain aligns with the From header. Publishing p=reject without working, aligned SPF/DKIM will get your own legitimate mail rejected.

What does the pct tag do?

pct applies your policy to only a percentage of failing mail — pct=25 with p=quarantine quarantines a quarter of failures and delivers the rest. It exists so large senders can phase in stricter policies gradually. Omit it (meaning 100) once you are confident.

Where do I publish the DMARC record?

As a TXT record on the host _dmarc under your domain — for example _dmarc.example.com. This generator shows the exact host name and value; you paste both into your DNS provider's control panel. Publishing and propagation are all that is left, since the value itself is validated here.

Related tools