DMARC Record Generator
Answer three questions and copy a correct DMARC record — with honest guidance about what each policy actually does. Generated in your browser; nothing you type is sent to us.
What is a DMARC record?
DMARC (RFC 7489) is the DNS policy that tells receiving servers what to do with mail that claims to be from your domain but fails SPF and DKIM in alignment with your From: address — and where to send the daily reports describing what they saw. It is the piece that turns SPF and DKIM from advisory signals into actual spoofing protection, and since 2024–2025 Google, Yahoo and Microsoft require it from bulk senders.
The safe rollout path
- Publish
p=nonewithrua=— pure monitoring; nothing can break. - Read the reports for 2–4 weeks — find every legitimate sender (the forgotten newsletter tool, the CRM, the invoicing app) and fix their SPF/DKIM.
- Move to
p=quarantine, optionally withpct=10rising over weeks. - Finish at
p=reject— full protection.
Frequently asked questions
Is p=none pointless?
No — it satisfies the providers' minimum bulk-sender requirement and turns on the reporting you need before enforcing. What is pointless is staying there forever: p=none provides zero spoofing protection, which is why the safe-rollout path above exists.
Do I need both rua and ruf?
Only rua= (aggregate reports) matters in practice. Forensic ruf=
reports contain message content, so most large receivers refuse to send them — this generator
deliberately omits ruf.
What does "alignment" mean?
SPF or DKIM passing is not enough — the domain that passed must match your From: domain. Relaxed alignment (the default) accepts subdomains (mail.you.com aligns with you.com); strict requires an exact match. Keep relaxed unless you have a specific reason.
How this tool works: This tool runs in your browser and on our server in real time. Depending on the tool, results are computed directly from the input you provide or retrieved from live, authoritative data sources at the moment you run a lookup. We do not sell your data, and your lookups are kept private — any history shown here is stored only on your device.