Free email tool
DMARC record generator
This DMARC record generator writes the TXT record that tells mail servers what to do with email that pretends to come from your domain. Choose a policy, add the address that should receive the reports and copy the record for _dmarc on your domain.
Free, no account needed
What is a good DMARC record to start with?
A safe first DMARC record is v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com, published as a TXT record on _dmarc.yourdomain.com. It changes nothing for delivery but gets you reports on who sends mail in your name. Once the reports show that all your real mail passes SPF or DKIM, move to p=quarantine and then to p=reject.
What the generator builds
The record always starts with v=DMARC1, followed by your policy. The other parts are only added when you fill them in, and the result updates as you type.
- p=none, p=quarantine or p=reject: what receivers should do with mail that fails DMARC
- rua=mailto:...: the address that receives aggregate reports from receiving mail servers
- pct: the share of mail the policy applies to, only added when you enter less than 100
- adkim=s and aspf=s: strict alignment, only when you tick that option
- The host to publish it on: _dmarc followed by your domain
How to read the result
The card stays orange while the policy is none or there is no report address, because the record then only partly protects your domain. It turns green with quarantine or reject and a report address.
DMARC passes when SPF or DKIM passes for a domain that matches the domain in the From line your recipients see. By default that match is relaxed: mail.yourdomain.com counts as a match for yourdomain.com. Strict alignment requires exactly the same domain, which can make mail from subdomains or some external services fail. Leave it off unless you know you need it.
About pct: the newest version of the DMARC standard, RFC 9989 (May 2026), removed the pct tag, because receivers rarely applied values other than 0 and 100 accurately. Keep the share at 100; the generator then leaves pct out of the record.
Common mistakes
DMARC is quick to publish, but it needs a few weeks of attention before you tighten it.
- Publishing the record on the domain itself instead of on _dmarc.yourdomain.com.
- Two DMARC records on _dmarc. Receivers then apply no DMARC policy at all.
- Going straight to p=reject without reading reports, so mail from a forgotten service such as your invoicing tool gets refused.
- Staying on p=none for good, so faked mail keeps getting delivered.
- Leaving out rua, so you never see the reports that tell you what to fix.
- Publishing DMARC while SPF and DKIM are both missing. DMARC builds on them and cannot pass without at least one.
What to do next
Add the record as a TXT record with the host _dmarc at your DNS provider. Receiving mail providers send their reports as XML files, so a separate mailbox or a report reading tool makes them easier to follow.
Read the reports for a few weeks. When every service that sends for you passes, change none to quarantine, and later to reject. This gradual route, starting in monitoring mode, is what the DMARC standard itself describes.
If you send more than 5,000 messages a day to Gmail addresses, Google requires a DMARC record; a policy of none meets that requirement.
How to use the generator
-
Enter your domain
Type the domain you send email from. The generator shows the _dmarc host the record belongs on.
-
Choose your policy
Pick none to start, add a report address and leave the share at 100.
-
Copy and publish
Copy the record, add it as a TXT record on _dmarc at your DNS provider and confirm it with the SPF and DMARC check.
Frequently asked questions
What does DMARC do?
DMARC tells receiving mail servers what to do with mail that uses your domain in the From line but does not pass SPF or DKIM for that domain. It also gets you reports, so you can see who sends mail in your name.
Which policy should I choose?
Start with none and a report address. Move to quarantine when the reports show that all your real mail passes, and to reject when you are confident. Reject gives the strongest protection against people faking your address.
Do I need SPF and DKIM before DMARC?
Yes, at least one of them. DMARC only passes when SPF or DKIM passes for a domain that aligns with your From domain. With both in place you still have a fallback when one of them fails.
Where do the DMARC reports go?
To the address in rua. Receiving mail providers send aggregate reports there that show which servers sent mail using your domain and whether it passed. Use an address you actually read, or a separate mailbox just for reports.
Should I use the pct setting?
Normally not. The current DMARC standard, RFC 9989, removed pct, so you cannot count on receivers applying a partial value. Leave it at 100 and go step by step with none, quarantine and reject instead.
Can I add DMARC to a SitePack domain?
Yes. In the DNS records of your domain you add a TXT record with the host _dmarc and the value from the generator. DNS management is included for free with your domain.
Related tools and guides
- SPF and DMARC check See whether your DMARC record is live and which policy it sets.
- SPF generator Build the SPF record DMARC relies on.
- Email on your own domain Set up an address like you@yourbusiness.com in three steps.
- Business email at SitePack A 5 GB mailbox with every package, extra mailboxes from €3.25 a month.
- Free tools
Email on your own domain, without the hassle
A website from €15 a month, billed yearly, with a domain, a 5 GB mailbox, SPF and DKIM set up for you and free DNS management for your DMARC record. Try it free for 14 days, no payment details needed.