Log in
Generator

DMARC record generator

Create a DMARC record: choose a policy, enter a report address, copy the finished DNS record.

What should happen to forged emails?
Advanced: alignment

Introduce DMARC in three stages

  1. Monitor: p=none with a report address, for two to four weeks.
  2. Secure: once all legitimate senders pass SPF or DKIM with an aligned domain, switch to p=quarantine.
  3. Complete: after further weeks without problems, switch to p=reject.

Check an existing record: DMARC checker · Background: SPF, DKIM and DMARC explained

FAQ

How do I create a DMARC record?

Choose a policy and an address for reports. The generator creates the TXT record that you add at _dmarc.yourdomain.com.

Which DMARC policy should I start with?

Start with p=none and reports. Check for two to four weeks whether all legitimate senders pass SPF or DKIM, then switch to p=quarantine and later to p=reject.

Do I need DMARC for Gmail and Yahoo?

Yes. Anyone sending a lot of email to Gmail or Yahoo needs at least a DMARC record, even with p=none. Without DMARC, bulk email is increasingly rejected.

Where do DMARC reports go?

To the address in the rua field. The XML reports are hard to read; with a free account Postwacht analyzes them automatically and shows you every sender using your domain.