DMARC Record Generator – Protect Your Domain from Email Spoofing
Email spoofing — where attackers send messages that appear to come from your domain — is one of the most common vectors for phishing attacks. DMARC (Domain-based Message Authentication, Reporting and Conformance) is a DNS policy that lets you instruct receiving mail servers to verify whether an incoming message truly originates from your domain and what to do when that verification fails.
What Is a DMARC Record?
A DMARC record is a DNS TXT record published at _dmarc.yourdomain.com. It references the results of two other email authentication standards — SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail) — to determine whether a message claiming to be from your domain is legitimate. If authentication fails, DMARC instructs the receiver to deliver, quarantine, or reject the message, depending on your policy.
The Three DMARC Policies
The policy tag p= is the core of any DMARC record and accepts three values:
- none — Takes no enforcement action. Mail is delivered normally regardless of authentication result. Use this while setting up to collect reports and identify legitimate senders before moving to enforcement.
- quarantine — Instructs receivers to treat failing messages as suspicious. In practice this usually means routing them to the recipient's spam or junk folder.
- reject — The strictest option. Receiving servers refuse to accept the message during the SMTP session, so it is never delivered.
The standard deployment path is p=none (monitor) → p=quarantine; pct=10 (gradually enforce) → p=reject (full protection). Skipping straight to reject without verifying your SPF and DKIM configuration can accidentally block legitimate email.
SPF and DKIM Alignment
DMARC passes only when the domain authenticated by SPF or DKIM aligns with the domain in the email's From: header. Two alignment modes exist for each:
- Relaxed (r) — The default. Subdomains of the From domain are considered aligned. For example, if your From address is
@example.com, a message signed bymail.example.compasses. - Strict (s) — Requires an exact domain match. Only use strict alignment if you specifically need to prevent lookalike subdomain abuse.
Aggregate and Forensic Reports
One of DMARC's most useful features is its reporting mechanism. The rua= tag specifies one or more mailto: addresses to receive aggregate reports — daily XML files summarising all messages that claimed to be from your domain, grouped by sending IP and authentication result. These reports are invaluable for discovering unauthorised senders and ensuring legitimate services like your marketing platform are properly authenticated.
The ruf= tag requests forensic (failure) reports — one per failing message. Because these can contain sensitive header or body information, many large receivers no longer send them. Enable ruf= only if you have a specific need and understand the privacy implications.
Gradual Rollout with pct=
The pct= tag lets you apply your policy to only a percentage of failing messages. Starting at pct=10 means 10% of failing messages are subject to quarantine or rejection while the remaining 90% are delivered normally. Increase gradually as you gain confidence in your authentication setup. The default is 100.
How to Publish Your DMARC Record
After generating your record with this tool, log in to your DNS provider and create a new TXT record with these values:
- Name / Host:
_dmarc(the full hostname becomes_dmarc.yourdomain.com) - Value: the DMARC string starting with
v=DMARC1 - TTL: 3600 seconds (1 hour) is a sensible default
Allow up to 48 hours for DNS propagation. You can verify your record is live by running dig TXT _dmarc.yourdomain.com or using any online DNS lookup tool.
Prerequisites Before Enabling DMARC
DMARC enforcement is only effective when at least one of SPF or DKIM is already correctly configured for your domain. Before setting p=quarantine or p=reject, make sure:
- Your SPF record lists all servers that send mail on behalf of your domain — including third-party services such as marketing platforms, CRMs, and support tools.
- DKIM signing is enabled for all sending services, and the DKIM
d=value aligns with your From domain. - You have reviewed at least two to four weeks of aggregate reports under
p=noneto confirm no legitimate sources are failing authentication.