Skip to content
Coupons 8

You have not saved any offers or providers yet. Tap the bookmark on an offer or choose Save on a provider profile.

    Monitoring free
    Monitor your website for free
    Coupons 8 Login
    Free tool

    DMARC Generator: create your DMARC record

    Decide what should happen to spoofed mail and where the reports go. The generator turns that into a valid DMARC record and explains every setting.

    Build your DMARC record

    To start with, a policy and a report address are all you need. Every other tag has a sensible default.

    Only used to show the host and the check link. The domain is not transmitted.

    What should happen to mail that fails the check?

    Receivers send their daily aggregate reports here. Separate several addresses with commas.

    More settings

    Reports about individual messages. Many large providers no longer send them for privacy reasons, as they can contain personal data.

    Your DNS record

    Type
    TXT
    Host / name
    _dmarc
    Value
    –
      Once it's live: run the DMARC check

      No guarantee for the result. Before moving to quarantine or reject, check that every service sending mail for you passes SPF or DKIM. Changes to your DNS are at your own risk.

      The generator runs entirely in your browser. We don't transmit or store anything you enter.

      What is a DMARC record?

      DMARC in one sentence

      DMARC is a TXT record at _dmarc.your-domain.com that tells receivers what to do with mail that claims to come from your domain but doesn't pass SPF or DKIM in alignment with it. It starts with v=DMARC1 and contains at least the policy p=.

      SPF, DKIM and DMARC at the receiver Incoming email From: hi@example.co.uk SPF May this IP send? ✓ DKIM Is the signature valid? ✓ DMARC Does SPF or DKIM match the From domain? none · quarantine · reject ✓ pass → inbox
      SPF, DKIM and DMARC at the receiver

      Why DMARC is part of the basics now

      On their own, SPF and DKIM don't check the sender address the recipient sees in their inbox. DMARC is what requires the checked domain to match that address (alignment). Since 2024, Gmail and Yahoo require a DMARC record from anyone sending more than 5,000 messages a day, and Microsoft followed for Outlook.com in 2025.

      The reports are the real benefit

      With rua you get daily XML reports from Gmail, Microsoft, Yahoo and many others: which servers sent mail in your name and whether SPF and DKIM passed. That way you find forgotten senders before you tighten the policy. DMARC services can turn these reports into something readable.

      The safe path to p=reject

      1. Start with p=none

        Publish the record with p=none and a report address. Delivery doesn't change, but you start receiving reports.

      2. Review the reports

        Spend two to four weeks looking at who sends in your name. If a legitimate service is missing, add it to your SPF record and set up DKIM for it.

      3. Move to quarantine

        Once all legitimate senders pass, switch to p=quarantine. To be careful, start with pct=25 and increase step by step.

      4. Set reject

        If the reports stay clean, switch to p=reject. From now on, receivers turn away spoofed mail using your domain.

      Every DMARC tag explained

      Tags are separated by semicolons. Only v and p are required. All others have defaults and can be left out if the default suits you.

      Tag Meaning Example
      v Version. Has to be the first tag. v=DMARC1
      p Policy for the domain: none (monitor only), quarantine (spam folder) or reject. Required. p=quarantine
      sp A separate policy for subdomains. If omitted, p applies. sp=reject
      rua Addresses for the daily aggregate reports, each prefixed with mailto:. rua=mailto:dmarc@your-domain.com
      ruf Addresses for reports about individual failed messages. Many providers no longer send them. ruf=mailto:dmarc@your-domain.com
      pct Share of mail in percent that quarantine or reject applies to. Default: 100. pct=25
      adkim DKIM alignment: r (relaxed, default) allows subdomains, s (strict) requires exactly the same domain. adkim=s
      aspf SPF alignment, with the same values as adkim. aspf=r
      fo When failure reports (ruf) are sent: 0 when everything fails (default), 1 when any check fails, d for DKIM, s for SPF. fo=1

      Frequently asked questions

      How do I create a DMARC record?

      Choose the policy above and enter a report address. The generator builds the value, which you add as a TXT record with the host _dmarc in your DNS settings. Some hosts want the full name _dmarc.your-domain.com instead.

      Which policy should I start with?

      p=none with a report address. That shows you who sends in your name without losing a single message. After a few weeks, move to quarantine and later to reject.

      Do I need SPF and DKIM first?

      Yes. DMARC builds on both: a message passes DMARC if SPF or DKIM passes and matches the sender domain. Set up SPF and DKIM for every service you send through first. Our SPF generator and DKIM generator help with that.

      Which address should I use for reports?

      Ideally a dedicated mailbox such as dmarc@your-domain.com, since you can get a lot of reports every day depending on your mail volume. If you use a DMARC service to analyse them, enter its address. If it's on a different domain, the service has to authorise that via DNS, which services usually set up themselves.

      Does the record cover subdomains?

      Yes. Subdomains without their own DMARC record inherit the main domain's policy, or the one from sp= if you set it. With sp=reject, for example, you protect every subdomain that never sends mail, even while the main domain is still at none.

      Can DMARC break anything?

      Not with p=none. With quarantine and reject, mail from services you forgot in SPF and DKIM lands in spam or isn't delivered at all. So review the reports first and tighten step by step. If you can't find a problem straight away, switch back to none for the time being.

      More free tools

      Check domains and websites with our free tools – quickly and without signing up.

      Availability

      Website Status Checker

      Check whether a website is online, how quickly it responds and how long its SSL certificate remains valid.

      Open tool       Infrastructure

      WHOIS & hosting check

      Identify a domain's hosting provider, IP address, nameservers and likely server location.

      Open tool       DNS & email

      DNS check

      Check every DNS record of a domain – with MX, SPF, DMARC, CNAME and nameserver checks.

      Open tool       Continuous monitoring

      Website monitoring

      Monitor websites and servers around the clock and receive immediate alerts by email, SMS or phone call when something goes down.

      Open tool       Domain

      Domain checker

      Check suitable domain names and find out which extensions are available for your project.

      Open tool       Hosting selection

      Web hosting advisor

      Answer a few questions about your website, application and requirements to find suitable plans from our hosting comparison.

      Open tool       Personal service

      Hosting tender

      Describe your project and receive non-binding, individually matched offers directly from hosting providers.

      Start tender