Deliverability toolRuns in your browserFree · No signup

DMARC Record Generator

Choose a policy, add a reporting address, and copy a correct DMARC record for the _dmarc host. Start at p=none, read the reports, then move to reject with the built-in rollout plan.

DMARC policy

The record updates as you change options.

Domain

The organizational domain in your From address. DMARC on the root also covers subdomains.

Policy (p)

Start here for cold email. Receivers deliver as normal and send you reports, so you can confirm every inbox and tool passes alignment before you enforce anything.

Subdomain policy (sp)

Optional. Leave inherited unless a subdomain needs a different rule.

Report interval (ri, seconds)

86400 = daily. Most receivers only send daily regardless.

Percentage of failing mail to apply the policy to (pct)100%

pct has no effect with p=none. It matters once you move to quarantine or reject.

Aggregate report address (rua)

Comma-separate multiple addresses. Use a mailbox or a report-processing service you actually read.

Forensic report address (ruf), optional

Per-message failure samples. Few receivers send them. Leave empty unless you need them.

DKIM alignment (adkim)

Relaxed is right for almost everyone.

SPF alignment (aspf)

Strict breaks tools that use a subdomain as envelope sender.

Failure reporting options (fo)

Only matters if ruf is set.

Your DMARC record

TypeTXTHost_dmarc (_dmarc)Valuev=DMARC1; p=none

Policy

none

monitor only

Reports

off

add rua

Alignment

r/r

dkim / spf

Add a reporting address

Without rua you will never learn which of your tools fails alignment. Reports are XML summaries by sending IP, not copies of your mail.

What each tag means

Tags in the generated DMARC record
Tag	Value	Meaning
`v`	`DMARC1`	Version. Always DMARC1 and must be the first tag.
`p`	`none`	Policy for mail from the domain that fails both SPF and DKIM alignment.

Rollout plan

1
Monitor
p=none; rua=mailto:…Weeks 1 to 4
Deliver everything, collect reports. Fix every source of your own mail that fails alignment: cold email inboxes, CRM, billing, support tools.
2
Quarantine a quarter
p=quarantine; pct=25Weeks 4 to 6
Send one in four failing messages to spam. Legitimate mail should already pass, so the only effect is on spoofers. Watch reply and bounce rates on every inbox.
3
Quarantine everything
p=quarantine; pct=100Weeks 6 to 8
All unaligned mail is quarantined. Reports should show near-zero failures from your own infrastructure.
4
Reject
p=rejectWeek 8 onward
Unaligned mail is refused outright. Keep rua in place and review reports monthly, since new tools get added and keys get rotated.

ColdBox checks DMARC alignment on every connected inbox and flags domains still sitting at p=none.

Start free trial

Nothing leaves your browserNo account or email requiredUnlimited use

How it works

How to use the DMARC Generator

01
Set the policy and reports
Start with p=none for a new cold email domain and add an rua address so you receive aggregate reports. Alignment defaults to relaxed.
02
Copy the TXT record
Publish the generated value as a TXT record on the _dmarc host of your domain. The tag table tells you what each part does.
03
Check and tighten over time
Use the checker to confirm the live record, then follow the rollout plan to quarantine and finally reject as reports show clean alignment.

What DMARC does that SPF and DKIM cannot

SPF authenticates the envelope sender and DKIM signs the message, but neither looks at the From address the recipient actually sees. DMARC (Domain-based Message Authentication, Reporting and Conformance) closes that gap. It tells receivers to check that at least one of SPF or DKIM passed and that the domain that passed aligns with the From header domain, then apply a policy you choose to anything that fails. It also asks receivers to send you reports about every message that used your domain, which is the only visibility you get into spoofing and misconfigured tools.

Alignment is the key concept. In relaxed mode, the authenticated domain only needs to share the organizational domain with the From header, so mail.example.com aligns with example.com. In strict mode they must match exactly. Relaxed is right for almost every cold email setup, because providers often use a subdomain as the envelope sender or DKIM d= domain. Strict SPF alignment in particular breaks many tools and gains nothing once DKIM aligns.

The record lives at _dmarc.yourdomain.com as a TXT record. Publishing it on the organizational domain covers every subdomain by default, so you do not need one per subdomain unless you want a different subdomain policy via the sp tag.

Every DMARC tag explained

A DMARC record is a semicolon-separated list of tag=value pairs. Only v and p are required; everything else has a default. The generator only includes tags that differ from the default, which keeps the record short and avoids typos.

v=DMARC1: version, must be first. p: policy for failing mail from the domain, one of none, quarantine or reject.
sp: policy for subdomains. Omit it to inherit p. Set sp=none while enforcing p=reject only if a subdomain sends unauthenticated mail on purpose.
pct: percentage of failing mail the policy applies to, 1 to 100. The remainder gets the next weaker policy. It has no effect at p=none.
rua: mailto address for aggregate reports, daily XML summaries per sending IP. ruf: address for forensic per-message samples, which most large receivers do not send.
adkim and aspf: alignment mode, r (relaxed) or s (strict). fo: when to generate forensic reports, 0 by default meaning only when both SPF and DKIM fail.
ri: requested report interval in seconds, default 86400. Most receivers send daily regardless of the value.
If rua points to a different domain, that domain must publish yourdomain.com._report._dmarc.reportdomain.com TXT "v=DMARC1" or receivers discard the reports.

Rollout plan for cold email domains

Cold email domains are a special case: they are new, they send at steady volume from a handful of inboxes, and a broken authentication setup costs replies immediately. Start every new domain at p=none with an rua address the day you register it. That satisfies the Gmail and Yahoo bulk sender requirement, which asks for a DMARC record with at least p=none, while you confirm that every inbox on the domain passes both SPF and DKIM with alignment.

After two to four weeks of reports showing only your own sending IPs, move to p=quarantine with pct=25. Legitimate mail is unaffected because it already passes; the only effect is on spoofed mail. Watch bounce and reply rates for a week, raise pct to 100, then switch to p=reject. A domain that stays at p=none for months is the most common finding in the checker above, and it means spoofers can use the domain freely while the owner believes they are protected.

Stage 1, weeks 1 to 4: p=none; rua=mailto:… Deliver everything, fix any inbox or tool that fails alignment.
Stage 2, weeks 4 to 6: p=quarantine; pct=25. Confirm reply rates hold.
Stage 3, weeks 6 to 8: p=quarantine; pct=100.
Stage 4, week 8 onward: p=reject. Keep rua and review reports monthly.

Reading aggregate reports and the mistakes that keep DMARC from working

Aggregate reports arrive as zipped XML, one per receiver per day, listing each sending IP, its SPF and DKIM results, alignment, and how many messages it sent. Reading them by hand is tedious at scale, so most teams route rua to a report-processing service that turns them into a dashboard. What you are looking for is simple: every IP that belongs to you should show pass on both checks with aligned domains, and every IP you do not recognize is either a forwarder, which is harmless, or a spoofer, which is exactly what the reject policy is for.

The mistakes are consistent. Publishing the record on the root instead of _dmarc. Two DMARC records on the same host, which invalidates both. Writing [email protected] without the mailto: prefix. Setting pct with p=none, which does nothing. Forgetting the external report authorization record when rua points to a service. And most of all, never revisiting the record: keys get rotated, new tools get added, and a domain at p=reject with a forgotten sending source silently loses mail. ColdBox surfaces the DMARC status of every connected domain next to its inbox health, so a policy stuck at none or a broken alignment shows up before it costs a campaign.

FAQ

DMARC Generator questions

Straight answers, no fluff. Still stuck? Our deliverability team replies within a couple of hours.

Ask a human

As a TXT record on the _dmarc host of your domain, so the full name is _dmarc.yourdomain.com. At most DNS hosts you enter _dmarc in the host or name field and the v=DMARC1 string in the value field. Publish it on the organizational domain; subdomains inherit the policy unless you set sp.

Yes. p=none delivers all mail normally while receivers send you aggregate reports, which is how you confirm every inbox and tool passes SPF and DKIM with alignment. It also satisfies the minimum Gmail and Yahoo require for bulk senders. Plan to move to quarantine after two to four weeks of clean reports and to reject after that.

Quarantine asks receivers to treat failing mail as suspicious, which in practice means the spam folder. Reject asks them to refuse it at SMTP time, so it is never delivered at all. Reject is the end state for a properly authenticated domain because it stops spoofed mail from reaching anyone and removes it from complaint statistics.

It applies the policy to only that percentage of failing messages, with the rest getting the next weaker treatment. pct=25 with p=quarantine sends one in four failing messages to spam and delivers the others, which lets you ramp enforcement gradually. It has no effect at p=none, since there is no weaker policy than none.

You need rua. Aggregate reports are how you see which IPs send as your domain and whether they pass alignment. ruf requests forensic per-message samples, which most large receivers never send for privacy reasons and which can contain message content when they do. Leave ruf empty unless you have a specific reason and a private mailbox for it.

Relaxed, in almost every case. It lets a subdomain such as mail.yourdomain.com align with yourdomain.com in the From header, which is how many providers set the envelope sender and DKIM domain. Strict requires an exact match and breaks tools without adding protection once DKIM is aligned. Use strict only if you have a specific reason and have verified every source.

The usual causes are a missing mailto: prefix in the rua tag, a record published on the wrong host, two DMARC records on the same name, or an rua address on a different domain that has not published the external report authorization record. Reports also only arrive from receivers that got mail from your domain in the previous day, so a domain not yet sending produces none.