DMARC Record Generator & Checker
Build a DMARC record with a safe rollout path from monitoring to enforcement, and check the policy a domain publishes today.
Build a policy on the left with a rollout path from monitoring to enforcement, or switch to the checker to read the DMARC record a domain publishes, tag by tag.
What receivers should do with mail that claims to be from your domain but fails both SPF and DKIM alignment.
Aggregate reports are the whole point of starting with DMARC: they show you every source sending as your domain.
How closely the SPF or DKIM domain must match the visible From domain. Relaxed suits most setups.
- Record type
- TXT
- Name / host
- _dmarc
- TTL
- 3600
Never jump straight to reject: you will block your own newsletters, invoices and helpdesk. Move one step at a time, reading your reports between each.
-
Weeks 1–4: watch
p=none; pct=100Publish with monitoring only and read the aggregate reports. Find every legitimate sender and get SPF or DKIM aligned for each. -
Weeks 5–6: quarantine a quarter
p=quarantine; pct=25Move to quarantine on a fraction of mail. Watch for complaints and for anything legitimate landing in spam. -
Weeks 7–8: quarantine everything
p=quarantine; pct=100Raise it to all mail. Reports should now show failures only from sources you do not recognise. -
Week 9 onwards: reject
p=reject; pct=100Switch to full enforcement, and keep reading the reports — new senders appear whenever a team signs up for a new tool.
| Tag | Value | What it means |
|---|
| Destination domain | Authorization record | Status |
|---|
About DMARC Record Generator & Checker
The DMARC Record Generator & Checker builds the `_dmarc` TXT record that tells receivers what to do when mail claiming to come from your domain fails both SPF and DKIM alignment — and, just as importantly, where to send the reports that show you who is sending as you. Since February 2024, Gmail and Yahoo have required a DMARC record from anyone sending bulk mail to their users.
The generator covers the policy, the subdomain policy, the percentage, the report addresses, the alignment modes, the failure options and the reporting interval, and lays out the rollout most domains should follow: monitor first, then quarantine a fraction, then quarantine everything, then reject. Jumping straight to reject is how organisations block their own invoices, newsletters and helpdesk replies.
The checker reads the record a domain publishes, explains every tag in plain language and validates it against RFC 7489. It reports a missing record, several records (which receivers treat as no policy at all), a version tag out of place, malformed or unknown tags, a `p=none` that has been sitting there for months, a `pct` below 100, and — a subtle one that silently loses your reports — a `rua` address on another domain that has not published the external destination authorization record RFC 7489 §7.1 requires. It also follows the organizational-domain fallback, so checking a subdomain shows the policy that actually applies to it.
How to use DMARC Record Generator & Checker
- Start on the Generator tab with the policy set to monitor only, and enter an address for aggregate reports.
- Leave alignment on relaxed unless you know a sender needs strict matching, and leave pct at 100.
- Publish the record as a TXT record named _dmarc on your domain.
- Read the aggregate reports for a few weeks and get SPF or DKIM aligned for every legitimate sender they reveal.
- Move to quarantine, then to reject, checking the reports between each step.
- Use the Checker tab at each stage to confirm the record parses and that your report destinations are authorized.