noshost

DMARC Generator

Choose a policy and where reports should go, and get a DMARC record to publish. Start with monitoring and tighten it once your reports look clean.

Policy

What should happen to mail that fails?

One or more addresses, separated by commas. Reports depend on receiving-provider participation. Use a mailbox or reporting service you can review.

Advanced options

Older receivers may ignore t=y. Begin with p=none while identifying your senders.

Copies of individual failed messages. Few providers still send them.

Your DMARC record

TXT record

TypeTXT
Name / host_dmarc
Value

Some DNS panels want just _dmarc as the name, others the full _dmarc.example.com. If yours adds the domain automatically, enter only _dmarc.

Before you publish

DMARC needs a passing SPF or DKIM identity aligned with the visible From domain. Strict alignment requires an exact match; relaxed alignment can permit different subdomains within the applicable organizational domain. Confirm real messages from every sending service with the Email Header Analyzer before tightening a policy.

A safe rollout

  1. Inventory: publish p=none with a report address. Read representative reports and list every service sending as your domain.
  2. Fix what fails: add missing services to SPF and turn on DKIM signing in each one.
  3. Review enforcement: consider p=quarantine after legitimate mail is correctly authenticated and aligned. Back up the prior record and monitor the effect.
  4. Reject: when reports show only your own services passing, move to p=reject.

Limitations

  • Reports arrive as zipped XML. They are hard to read by hand, so most people send them to a report service. Several offer a free tier.
  • Mailing lists and forwarding can make legitimate mail fail DMARC. Review reports for these before moving to reject.
  • RFC 9989 removed pct in May 2026. This generator uses optional t=y, with a receiver-compatibility warning, rather than promising percentage rollout.
↑ ↓ moveEnter openEsc close

Expanded view