Free tool · no signup

DMARC record generator

Build the DMARC record that stops criminals sending email as your domain. Pick a policy and a report address, copy the record, and follow the rollout steps so real mail keeps flowing.

By the Bug Circuit security team · Last updated October 25, 2026

Your policy

Your domainPolicy for mail that failsStart with none, read the reports for a few weeks, then move to quarantine and finally reject.Report address for daily summaries (rua)One or more email addresses, one per line. Use a mailbox or a DMARC reporting service.

Policy for subdomainsApply to % of mailDKIM alignmentSPF alignment

Failure reports (ruf, optional)Most providers do not send these. Leave empty unless you need them.

TXT record value

v=DMARC1; p=none

Type: TXT
Name / host: _dmarc

p=none only watches: spoofed mail is still delivered. It is the right place to start, but plan to move to quarantine and then reject once your legitimate senders pass.
Add an rua address. Without aggregate reports you cannot see who is sending mail as your domain, so you cannot safely tighten the policy.

What is a DMARC record? A DNS TXT record at _dmarc.yourdomain that tells receivers what to do with mail that fails SPF and DKIM, and where to send reports. Start with p=none and a report address, read the reports for a few weeks, then move to quarantine and reject.

How it works

What DMARC adds to SPF and DKIM

SPF and DKIM check technical details that attackers do not have to match. DMARC (RFC 7489) adds the missing link: it requires that the domain SPF or DKIM validated is the same one the reader sees in the From line, and it tells receivers what to do when that fails: p=none (just report), p=quarantine (send to spam) or p=reject (block).

Large mailbox providers now expect senders of bulk mail to have DMARC, and it is the single most effective control against someone sending convincing fake emails from your domain.

A rollout that does not lose real mail

Week 1: publish p=none with an rua address. Nothing is blocked, but you start receiving daily XML reports of every server that sends mail as your domain. Week 2 to 4: find any legitimate sender that fails (a forgotten newsletter tool, an old CRM) and fix its SPF or DKIM. Then move to p=quarantine with pct=25, raise the percentage as reports stay clean, and finally p=reject.

The generator warns you if a report address is on another domain, because that domain must publish a small DNS record to accept your reports, and if you are still on p=none.

The tags in the record

v=DMARC1 starts the record and p sets the policy. sp sets a different policy for subdomains. pct applies the policy to a percentage of failing mail. rua is where daily summaries go, ruf is for individual failure reports (many providers never send them). adkim and aspf choose relaxed or strict alignment: relaxed lets a subdomain match its parent domain, strict needs an exact match.

Worked examples

Step one: monitor only

Policy none, reports to dmarc@yourcompany.com.

v=DMARC1; p=none; rua=mailto:dmarc@yourcompany.com

Publish this first. Add it as a TXT record named _dmarc.

Step two: quarantine a quarter of failing mail

Policy quarantine, 25 percent.

v=DMARC1; p=quarantine; pct=25; rua=mailto:dmarc@yourcompany.com

Only a sample of failing mail goes to spam while you watch the reports.

Step three: reject, with a stricter subdomain policy

Policy reject, subdomains reject, strict alignment.

v=DMARC1; p=reject; sp=reject; rua=mailto:dmarc@yourcompany.com; adkim=s; aspf=s

The goal state. Make sure every legitimate sender passes before you get here.

Frequently asked questions

Where do I publish a DMARC record?

As a TXT record with the name _dmarc (your DNS provider adds the domain for you). The value is the record the generator gives you.

Will DMARC block my own email?

Only mail that fails both SPF and DKIM alignment, and only once your policy is quarantine or reject. That is why you start with p=none and read the reports before tightening.

What is the rua address for?

It receives daily aggregate reports, as compressed XML, from the mailbox providers that handled mail claiming to be from you. They show which servers send as your domain and whether they pass. Use a dedicated mailbox or a reporting service, because the volume can be high.

What does pct do?

It applies your policy to only that percentage of failing messages. It lets you roll out quarantine or reject gradually. Set it to 100 (or leave it out) when you are confident.

Do I need DMARC if I only send a few emails?

Yes. Criminals do not care how much mail you send. DMARC protects your name from being faked, and Gmail, Yahoo and Microsoft expect it from bulk senders.

How do I check that it works?

Use the email spoofing checker on your domain. It reads your SPF, DKIM and DMARC records and tells you whether your domain can be spoofed.

Keep reading

Email Spoofing CheckerTest the result.SPF Record GeneratorThe first half of email authentication.DNS Record LookupSee your published records.Small business security checklistA list you can work through yourself.

See what attackers see, for free

Run the free passive check on your website. No login, no impact on your site, results in seconds.

Ready for the full manual audit? See pricing