Free DMARC Generator

01 · Definition

What is dmarc generator?

A DMARC generator builds the v=DMARC1 TXT record that tells receiving mail servers how to handle messages that fail SPF or DKIM alignment. DMARC requires choosing an enforcement policy (none, quarantine, or reject), deciding how subdomains are treated, and optionally specifying where to send aggregate and forensic failure reports. Getting the syntax wrong — a missing semicolon, an invalid tag value, or a mistyped email URI — can render the record malformed and invisible to receivers.

The tool above takes your domain, policy choices, and reporting addresses and assembles a correctly formatted v=DMARC1 record in one step. Choose your enforcement level, set a subdomain policy, add an rua= reporting address, and the generator outputs a TXT value ready to publish at _dmarc.yourdomain.com. Read the in-depth DMARC generator guide for a full walkthrough of each tag, the recommended rollout path, and what to do once aggregate reports start arriving.

02 · Process

How it works

1. 1Enter your domain.The generated record will be published as a TXT entry at _dmarc.yourdomain.com — the underscore-prefixed subdomain is the RFC 7489-mandated location for DMARC records.
2. 2Choose your enforcement policy.none gathers reports but takes no action. quarantine diverts failing messages to junk. reject drops them at the gateway. Start at none to build a baseline, then escalate.
3. 3Set the subdomain policy.If omitted, subdomains inherit the root policy. Use sp=none to keep subdomains in monitoring mode while the root domain enforces — useful when rolling out new subdomains for transactional mail.
4. 4Add a reporting address.The rua= address receives daily XML digests from participating receivers, showing every IP that sent mail claiming your domain and whether each message passed or failed. Without it, you are blind to your own failure rate.
5. 5Publish the record in DNS.Copy the generated v=DMARC1 string and add it as a TXT record at _dmarc.yourdomain.com. Allow up to 48 hours for propagation, then verify with the DMARC lookup tool.

03 · Risk

Why it matters

DMARC is the policy layer that turns SPF and DKIM authentication into enforcement. Without a DMARC record, even a domain with perfect SPF and DKIM provides no protection against From-header spoofing — the address the recipient actually sees. With a p=reject policy in place, messages that fail authentication are dropped at the gateway before they reach any inbox.

The publishing requirement has teeth. Google and Yahoo mandated at minimum p=none with an rua= address for bulk senders from February 2024. Non-compliance means mail goes to spam or is rejected. For financial services firms under FCA Consumer Duty, the inability to demonstrate authenticated outbound communications is an audit finding, not just a deliverability risk.

04 · Use cases

Common ways to use this tool

• New domain setup. Before the first send from a new domain, generate and publish a p=none DMARC record with an rua= address so you start collecting authentication reports from day one.
• Policy escalation. Moving from p=none to p=quarantine to p=reject requires generating an updated record for each stage. The generator lets you set pct=10 at quarantine and raise it incrementally.
• Subdomain isolation. When adding new transactional subdomains, generate with sp=none to keep those subdomains in monitoring mode while the root domain stays at p=reject.
• Reporting setup. Generate a record that adds rua= and ruf= addresses to an existing p=none policy — the first step to understanding your current authentication landscape before tightening enforcement.

05 · Interpretation

What to check in the result

Before publishing the generated record, confirm these points:

• Policy matches your current rollout phase. p=none is safe to publish immediately. p=quarantine or p=reject require SPF and DKIM to be passing for all legitimate senders first — check with the email health check tool.
• Reporting address is reachable. The rua= address will receive daily XML reports from major mailbox providers. Make sure the inbox exists and someone is monitoring it — or pipe it to a DMARC reporting service.
• Percentage is appropriate for your phase. pct=100 at p=quarantine or p=reject applies the policy to every failing message. During rollout, start at pct=10 and raise it as you verify no legitimate senders are failing.
• Subdomain policy reflects your subdomain landscape. If you have active sending subdomains (e.g. mail.yourdomain.com), confirm they have DKIM configured before a p=reject root policy pushes them into the same enforcement.
• Only one DMARC record per domain. There must be exactly one TXT record at _dmarc.yourdomain.com. Publishing a second record alongside an existing one causes evaluation errors at receivers — delete the old one first.