DMARC Record Generator

How do I create a DMARC record?

Reviewed by Prabath Thalangama · Last updated October 23, 2026

Publish a TXT record at _dmarc.yourdomain starting v=DMARC1 with a policy (p=none, quarantine or reject) and a rua address for aggregate reports. This generator builds the record from a form, including subdomain policy, percentage, forensic reports and strict or relaxed alignment, and warns when an option weakens it.

The usual rollout is p=none with rua reports for a few weeks, fixing every legitimate sender that fails, then quarantine, then reject. The generator warns when p=none is chosen because it only monitors.

Tags at their defaults are left out to keep the record short: pct=100, adkim=r, aspf=r and ri=86400 are what receivers assume when those tags are missing.

How do I generate a DMARC record?

Choose the policy. Start with none if you have never collected reports for the domain.
Enter a rua address for daily aggregate reports. A dedicated mailbox or a DMARC reporting service handles the XML best.
Leave alignment relaxed unless you know every sender uses exactly your domain.
Publish the record as a TXT record on _dmarc, then check it with the DMARC checker.

How to read the results

p / sp: The policy for the domain and, optionally, a different one for its subdomains.
pct: The share of failing mail the policy applies to. Included only when it isn't 100.
rua / ruf: Where aggregate and failure reports go, as mailto: addresses. Few providers send failure (ruf) reports.
adkim / aspf: s requires the DKIM or SPF domain to match the From domain exactly; r (the default) also accepts subdomains of the same organisational domain.
fo: When to send failure reports. Included only together with a ruf address.

Common DMARC record mistakes

Record published at the root of the domain

DMARC is only read from _dmarc.yourdomain. Move the record there.

Reports to another domain are never received

If rua points at a different domain, that domain must publish an authorisation record, or receivers drop the reports.

example.com._report._dmarc.reports.example.net. TXT "v=DMARC1"

Jumping straight to p=reject

Unlisted senders such as a CRM or ticketing system will be rejected. Collect reports at p=none first.

Examples and command-line equivalents

Monitoring only

_dmarc.example.com.  TXT  "v=DMARC1; p=none; rua=mailto:[email protected]"

Full enforcement with a relaxed subdomain policy

_dmarc.example.com.  TXT  "v=DMARC1; p=reject; sp=quarantine; rua=mailto:[email protected]"

Frequently asked questions

What host name does the DMARC record use?

Create a TXT record with the host _dmarc (so the full name is _dmarc.example.com). Do not put it at the root of the domain.

Should I use pct= to roll out enforcement?

pct lets you apply quarantine or reject to a percentage of failing mail, which is a gentle way to step up enforcement. Remove it (meaning 100%) once you are confident.

Do I need a separate DMARC record for subdomains?

No. Subdomains without their own record inherit the organisational domain's record, using sp= if it is set and p= otherwise.