How to use the DMARC Generator
- Enter your domain (optional, but it fills in the host name and lets us spot external report addresses).
- Pick a policy. Use
noneuntil your reports show every legitimate sender passes. - Add at least one aggregate report address (
rua). - Leave the advanced settings at their defaults unless you have a reason to change them.
- Publish the record at
_dmarc.yourdomain, then check it with the DMARC Checker.
The generator works without JavaScript and doesn't query DNS. Your choices aren't stored.
What each setting means
The tags follow RFC 9989, which replaced RFC 7489 in 2026. Existing v=DMARC1 records keep working.
| Tag | Meaning | Default |
|---|---|---|
p |
What receivers should do with mail that fails DMARC: none, quarantine or reject | required |
sp |
Policy for subdomains | same as p |
np |
Policy for subdomains that don't exist (new in RFC 9989) | same as sp |
t |
t=y is testing mode: receivers apply a weaker action while you roll out a stricter policy (new in RFC 9989) |
n |
pct |
Legacy: apply the policy to only part of failing mail. Removed in RFC 9989, still honored by older receivers | 100 |
rua |
Where aggregate reports go | none |
ruf |
Where failure reports go | none |
adkim, aspf |
DKIM and SPF alignment: relaxed (r, subdomains align) or strict (s, exact match) |
r |
fo |
When to send failure reports: 0 both fail, 1 either fails, d DKIM fails, s SPF fails |
0 |
The generator leaves out tags that are set to their default, which keeps the record short.
Report addresses
Addresses must be valid email addresses at a public domain. We add the mailto: prefix for you. You can list up to five, separated by commas.
If an address is at a different domain from yours, that domain must publish an authorization record, for example:
example.com._report._dmarc.reports.example.net. TXT "v=DMARC1"
This is described in RFC 9990 section 4 (previously RFC 7489 section 7.1). The DMARC Checker looks for it once your record is live.
Common problems and fixes
Starting at reject. If a legitimate service isn't passing SPF or DKIM yet, its mail will be rejected. Start at none. Our guide on moving from none to reject has a safe timeline.
sp=none with an enforced policy. This leaves every subdomain open to spoofing. Leave sp unset unless a subdomain still needs monitoring.
Two DMARC records. Receivers ignore DMARC entirely if they find more than one. Replace your old record rather than adding a new one.
No reports arriving. Check the address for typos, and for external addresses, check the authorization record above.
Limitations
- The generator builds a valid record. It can't tell you whether your mail will pass; only your DMARC reports show that.
- Parked domains that never send mail should use
p=rejectwith SPFv=spf1 -all. Use the SPF Generator for that record.
Related
See DMARC record examples for common setups, or read SPF vs DKIM vs DMARC.
Frequently asked questions
Which DMARC policy should I start with?
Start with p=none and a rua address. You'll receive daily aggregate reports showing every server that sends as your domain. Once all legitimate mail passes, move to p=quarantine, then p=reject. Jumping straight to reject can block your own mail.
Where do I publish the DMARC record?
As a TXT record on the host _dmarc under your domain, for example _dmarc.example.com. Many DNS panels want just _dmarc as the host name. There must be only one DMARC record per domain.
Should I still use pct?
RFC 9989, the current DMARC standard, removed pct. Receivers that follow it ignore pct; older ones still honor it. For a gradual rollout, the new standard uses t=y (testing mode). The generator supports both and explains the difference.
Can my reports go to another company?
Yes, but the receiving domain must publish a record authorizing it to receive reports for your domain (RFC 9990 section 4). DMARC report services set this up for their customers. If it's missing, receivers won't send the reports.
Should I request failure reports (ruf)?
Only if you have a reason to. Few large mailbox providers send them, and the ones that arrive can contain parts of real messages, so the mailbox needs care. Aggregate reports (rua) are what you need to move to enforcement.
Related guides
DMARC record examples, explained tag by tag
Copy-paste DMARC record examples for monitoring, quarantine and reject, with each tag explained and what RFC 9989 changed: pct removed, t, np and psd added.
9 min read SPF, DKIM & DMARCDMARC alignment: relaxed vs strict, and what adkim and aspf do
How DMARC alignment works, what adkim and aspf do, how the organizational domain is found, a pass/fail examples table, and when strict alignment is worth it.
9 min read SPF, DKIM & DMARCDMARC rua and ruf: how to set up DMARC reporting addresses
What DMARC rua and ruf do, the mailto syntax, how to send reports to another domain with a _report._dmarc record, failure report privacy and report volume.
9 min read