Free · live registry data · no login

DMARC Record Generator

Create a DMARC record with the right policy for your stage.

How it works

DMARC record generator: the right policy for where you are today

Pick your rollout stage, where reports should go and how alignment should behave, and we produce a valid DMARC TXT record with the host name, TTL and a line-by-line explanation. The generator validates report addresses, warns when a reporting address is on another domain (which needs an authorisation record there) and fetches your current live DMARC record so you can see exactly what will change. Start at monitor mode, graduate to quarantine and reject with confidence.

Or start from an example

Results appear here after you click Generate DMARC record.

How this works

  1. 1

    Choose your stage

    Monitor, quarantine or reject map directly to the p= tag, with optional percentage for gradual rollout.

  2. 2

    Validate reporting

    Report addresses are checked for syntax and cross-domain authorisation requirements.

  3. 3

    Compare with live DNS

    Your current _dmarc record is fetched so you see whether you are adding, upgrading or downgrading.

Frequently asked questions

What DMARC policy should a new domain start with?
Start with p=none and a rua address. It blocks nothing but gives you reports showing every source sending as your domain, so you can fix SPF and DKIM before enforcing.
What is pct in a DMARC record?
pct tells receivers to apply the policy to only that percentage of failing messages, treating the rest as p=none. It lets you move to quarantine gradually; pct=100 is the default and the final state.
Can DMARC reports go to a different domain?
Yes, but the receiving domain must publish an authorisation TXT record at yourdomain._report._dmarc.theirdomain, otherwise receivers will not send reports. DMARC reporting services create this record for you.
Should I set sp (subdomain policy)?
Usually leave it out so subdomains inherit the main policy. Set sp explicitly only if subdomains legitimately need a different policy, for example while migrating a newsletter subdomain.
What does fo=1 do?
fo=1 asks receivers to send a forensic report when either SPF or DKIM fails, rather than only when both fail. Few receivers send forensic reports, but it costs nothing to request them.

Every MailShrine domain includes WHOIS privacy, transfer lock, Anycast DNS with DNSSEC and two business mailboxes.

Register a domainHow to set up DMARC on a new domainSPF, DKIM and DMARC explainedMore tools in this category