# DMARC Record Generator

URL: https://iblockspam.com/tools/dmarc-generator
Last updated: 2026-10-09

> Choose a policy and where reports should go, and get a ready-to-publish _dmarc TXT record with plain-English notes on each setting.

Free tool: Build a DMARC record with the right policy, reporting and alignment settings. Use it at https://iblockspam.com/tools/dmarc-generator

## How to use the DMARC Generator

1. Enter your domain (optional, but it fills in the host name and lets us spot external report addresses).
2. Pick a policy. Use `none` until your reports show every legitimate sender passes.
3. Add at least one aggregate report address (`rua`).
4. Leave the advanced settings at their defaults unless you have a reason to change them.
5. Publish the record at `_dmarc.yourdomain`, then check it with the [DMARC Checker](https://iblockspam.com/tools/dmarc-checker).

The generator works without JavaScript and doesn't query DNS. Your choices aren't stored.

## What each setting means

The tags follow [RFC 9989](https://www.rfc-editor.org/rfc/rfc9989.html), which replaced RFC 7489 in 2026. Existing `v=DMARC1` records keep working.

| Tag | Meaning | Default |
|---|---|---|
| `p` | What receivers should do with mail that fails DMARC: none, quarantine or reject | required |
| `sp` | Policy for subdomains | same as `p` |
| `np` | Policy for subdomains that don't exist (new in RFC 9989) | same as `sp` |
| `t` | `t=y` is testing mode: receivers apply a weaker action while you roll out a stricter policy (new in RFC 9989) | `n` |
| `pct` | Legacy: apply the policy to only part of failing mail. Removed in RFC 9989, still honored by older receivers | 100 |
| `rua` | Where aggregate reports go | none |
| `ruf` | Where failure reports go | none |
| `adkim`, `aspf` | DKIM and SPF alignment: relaxed (`r`, subdomains align) or strict (`s`, exact match) | `r` |
| `fo` | When to send failure reports: `0` both fail, `1` either fails, `d` DKIM fails, `s` SPF fails | `0` |

The generator leaves out tags that are set to their default, which keeps the record short.

## Report addresses

Addresses must be valid email addresses at a public domain. We add the `mailto:` prefix for you. You can list up to five, separated by commas.

If an address is at a different domain from yours, that domain must publish an authorization record, for example:

```
example.com._report._dmarc.reports.example.net.  TXT  "v=DMARC1"
```

This is described in [RFC 9990 section 4](https://www.rfc-editor.org/rfc/rfc9990.html#section-4) (previously RFC 7489 section 7.1). The DMARC Checker looks for it once your record is live.

## Common problems and fixes

**Starting at reject.** If a legitimate service isn't passing SPF or DKIM yet, its mail will be rejected. Start at `none`. Our guide on [moving from none to reject](https://iblockspam.com/blog/dmarc-none-to-reject-small-business) has a safe timeline.

**`sp=none` with an enforced policy.** This leaves every subdomain open to spoofing. Leave `sp` unset unless a subdomain still needs monitoring.

**Two DMARC records.** Receivers ignore DMARC entirely if they find more than one. Replace your old record rather than adding a new one.

**No reports arriving.** Check the address for typos, and for external addresses, check the authorization record above.

## Limitations

- The generator builds a valid record. It can't tell you whether your mail will pass; only your DMARC reports show that.
- Parked domains that never send mail should use `p=reject` with SPF `v=spf1 -all`. Use the [SPF Generator](https://iblockspam.com/tools/spf-generator) for that record.

## Related

See [DMARC record examples](https://iblockspam.com/blog/dmarc-record-examples) for common setups, or read [SPF vs DKIM vs DMARC](https://iblockspam.com/blog/spf-vs-dkim-vs-dmarc).

## Frequently asked questions

### Which DMARC policy should I start with?

Start with p=none and a rua address. You'll receive daily aggregate reports showing every server that sends as your domain. Once all legitimate mail passes, move to p=quarantine, then p=reject. Jumping straight to reject can block your own mail.

### Where do I publish the DMARC record?

As a TXT record on the host _dmarc under your domain, for example _dmarc.example.com. Many DNS panels want just _dmarc as the host name. There must be only one DMARC record per domain.

### Should I still use pct?

RFC 9989, the current DMARC standard, removed pct. Receivers that follow it ignore pct; older ones still honor it. For a gradual rollout, the new standard uses t=y (testing mode). The generator supports both and explains the difference.

### Can my reports go to another company?

Yes, but the receiving domain must publish a record authorizing it to receive reports for your domain (RFC 9990 section 4). DMARC report services set this up for their customers. If it's missing, receivers won't send the reports.

### Should I request failure reports (ruf)?

Only if you have a reason to. Few large mailbox providers send them, and the ones that arrive can contain parts of real messages, so the mailbox needs care. Aggregate reports (rua) are what you need to move to enforcement.

---

Source: iBlockSpam, https://iblockspam.com/tools/dmarc-generator (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt