01
Start with observation
The initial value is v=DMARC1; p=none. This requests no special handling of failing mail. Add a rua mailbox you control if you want aggregate evidence; an empty rua is allowed but no reports are requested.
Email Dev Tools
DMARC record generator
Choose a policy or paste one TXT value. Review the tag meanings and delivery risks before changing DNS.
DMARC record generator
TXT host Add a domain to show the host
v=DMARC1; p=none
Effective settings
- Domain
- none
- Subdomains
- none
- Nonexistent subdomains
- none
- DKIM
- r
- SPF
- r
- v=DMARC1 — Version
- p=none — Domain policy
Processed in this browser; no DNS query or update is sent.
Policy options
Record ready. Review warnings before publishing.
Review before publishing
- Without rua, no aggregate reports are requested.
A DMARC record generator is useful when a new sending domain needs a safe first policy or an inherited subdomain rule is unclear. A single character in a report URI can stop the feedback you expected, while an early reject policy can affect real mail.
This workbench shows the TXT value and its effective policy side by side. The DMARC record generator builds according to RFC 9989 and can read older records without silently deleting their historical tags. It checks local syntax; publishing and live mail authentication remain separate steps.
Why use this DMARC record generator
See the current policy and the intent of an older record in one place.
Build for the current RFC
Many web forms still add pct, rf or ri. This DMARC record generator leaves those removed tags out of new values, starts at p=none, and shows when a separate sp or np rule would override inherited policy. It does not claim that test mode is a precise rollout percentage.
Read before replacing
Paste a TXT value to see each tag, the resulting domain and subdomain policies, and warnings for report destinations. Historical pct, rf and ri remain visible with a version warning; no automatic migration changes the original record or its intent.
Review the policy before a DNS change
02
Check overrides and addresses
Leaving sp and np at Inherit omits both tags. Strict alignment requires exact domain matches, while relaxed is the default. Multiple rua or ruf mailboxes are comma separated; an address outside your domain requires authorization in the destination DNS.
03
Separate syntax from delivery
Automatic processing waits 350 ms and disables export as soon as an option changes; turn it off for the button or Ctrl/Cmd + Enter. After copying the TXT value, publish one record at _dmarc and check real SPF/DKIM alignment and reports before enforcing rejection.
Policy, alignment and reports in one record
Explicit inheritance
Select none, quarantine or reject for p. Leave sp and np inherited unless a different subdomain policy is deliberate. The result lists the effective policy for the domain, existing subdomains and nonexistent subdomains, even when their optional tags are omitted.
Report URI handling
Enter one or more comma separated email addresses for rua or ruf. The builder adds mailto: to bare addresses and rejects malformed recipients; the parser accepts other syntactically valid URI schemes but cannot promise receiver support. The fo condition is emitted only when ruf is present.
Legacy-aware static parser
The parser catches duplicate tags, malformed separators, unsupported values and misplaced required tags with a character position. It preserves unknown tags rather than treating them as fatal, and identifies pct, rf and ri as old RFC 7489 fields instead of silently rewriting them.
What a local TXT check can establish
- No DNS or mail test
- The page does not query _dmarc, edit DNS, send a message or inspect SPF/DKIM on a real sender. A syntactically valid DMARC TXT record cannot establish publication, authentication success or delivery. Use a live checker and aggregate reports after publication.
- No percentage rollout promise
- RFC 9989 removed pct because receiver behavior for intermediate values was inconsistent. An existing pct=25 is shown with its old value, not rejected solely for age. New records never emit pct, rf or ri; t=y is a test signal and cannot replace a 25 percent rollout.
- External reports need authorization
- A rua or ruf address at another domain can require an authorization TXT record controlled by that destination domain. This builder can flag a domain mismatch when you supply your domain; without DNS access it cannot verify consent or that reports will arrive.
- One policy value, not a report analyzer
- Paste one DMARC TXT value, not multiple DNS answers, XML aggregate reports or email headers. The parser cannot detect duplicate live TXT records. The builder never converts a pasted legacy value into a new form automatically, because removing tags can change operational intent.
DMARC record generator questions
What’s a good DMARC record to start with?
Begin with v=DMARC1; p=none and add rua=mailto:reports@yourdomain when that mailbox exists. The DMARC record generator shows a bare p=none first, so you can choose a real report destination rather than publish a placeholder.
What does p=none, quarantine, and reject mean?
p=none asks receivers to observe. quarantine asks them to treat failures as suspicious, often by placing mail in spam. reject asks them to refuse failing messages. Review legitimate senders and alignment in reports before strengthening either policy.
Where do I publish the DMARC record?
Publish the generated value as a TXT record at _dmarc.yourdomain.com, or enter _dmarc when the DNS provider appends the zone. This page does not publish it. Verify that only one applicable DMARC policy record is live.
What are rua and ruf reports?
rua destinations receive aggregate reports about authentication results. ruf requests per-message failure reports, which can contain sensitive details and may not be sent by many receivers. This builder keeps ruf empty by default and omits fo without it.
What happens if I use a deprecated tag like pct= today?
RFC 9989 removed pct, rf and ri from current policy records. An older pct value is still parsed and reported as historical, not presented as a reliable percentage guarantee. Rebuild a current policy deliberately rather than assuming t=y equals the old percentage.
Still have a DMARC policy question?
Open the DMARC record generator
Use the DMARC record generator to inspect a policy, then confirm its live DNS record and authentication reports before changing enforcement.