Logo

MonoCalc

/

DMARC Record Generator

Networking
Used to preview the full DNS entry at _dmarc.yourdomain.com

DMARC Policy (p=)

What should receivers do when an email fails DMARC authentication?

Aggregate Report Addresses (rua)

Daily XML summaries of authentication results — recommended for all domains

Generated DMARC Record

RFC 7489

DNS TXT record value

Zone file entry

Publishing instructions: Add a TXT record at _dmarc.yourdomain.com with the value above. Note the _dmarc. subdomain prefix — this is required by RFC 7489.

Recommendations

Policy "none" takes no enforcement action. Use it for monitoring only, then move to "quarantine" or "reject" once you verify your SPF/DKIM setup.

No aggregate report (rua) address configured. Add an rua address to receive daily summaries about who is sending email for your domain.

DMARC Tag Reference

v=DMARC1

Version (required)

p=none|quarantine|reject

Domain policy (required)

sp=

Subdomain policy override

aspf=r|s

SPF alignment (r=relaxed, s=strict)

adkim=r|s

DKIM alignment (r=relaxed, s=strict)

pct=

% of messages subject to policy (1–100)

rua=mailto:

Aggregate report URI

ruf=mailto:

Forensic report URI

fo=

Failure reporting conditions (0,1,d,s)

ri=

Report interval in seconds (default 86400)

About This Tool

DMARC Record Generator – Protect Your Domain from Email Spoofing

Email spoofing — where attackers send messages that appear to come from your domain — is one of the most common vectors for phishing attacks. DMARC (Domain-based Message Authentication, Reporting and Conformance) is a DNS policy that lets you instruct receiving mail servers to verify whether an incoming message truly originates from your domain and what to do when that verification fails.

What Is a DMARC Record?

A DMARC record is a DNS TXT record published at _dmarc.yourdomain.com. It references the results of two other email authentication standards — SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail) — to determine whether a message claiming to be from your domain is legitimate. If authentication fails, DMARC instructs the receiver to deliver, quarantine, or reject the message, depending on your policy.

The Three DMARC Policies

The policy tag p= is the core of any DMARC record and accepts three values:

  • none — Takes no enforcement action. Mail is delivered normally regardless of authentication result. Use this while setting up to collect reports and identify legitimate senders before moving to enforcement.
  • quarantine — Instructs receivers to treat failing messages as suspicious. In practice this usually means routing them to the recipient's spam or junk folder.
  • reject — The strictest option. Receiving servers refuse to accept the message during the SMTP session, so it is never delivered.

The standard deployment path is p=none (monitor) → p=quarantine; pct=10 (gradually enforce) → p=reject (full protection). Skipping straight to reject without verifying your SPF and DKIM configuration can accidentally block legitimate email.

SPF and DKIM Alignment

DMARC passes only when the domain authenticated by SPF or DKIM aligns with the domain in the email's From: header. Two alignment modes exist for each:

  • Relaxed (r) — The default. Subdomains of the From domain are considered aligned. For example, if your From address is @example.com, a message signed by mail.example.com passes.
  • Strict (s) — Requires an exact domain match. Only use strict alignment if you specifically need to prevent lookalike subdomain abuse.

Aggregate and Forensic Reports

One of DMARC's most useful features is its reporting mechanism. The rua= tag specifies one or more mailto: addresses to receive aggregate reports — daily XML files summarising all messages that claimed to be from your domain, grouped by sending IP and authentication result. These reports are invaluable for discovering unauthorised senders and ensuring legitimate services like your marketing platform are properly authenticated.

The ruf= tag requests forensic (failure) reports — one per failing message. Because these can contain sensitive header or body information, many large receivers no longer send them. Enable ruf= only if you have a specific need and understand the privacy implications.

Gradual Rollout with pct=

The pct= tag lets you apply your policy to only a percentage of failing messages. Starting at pct=10 means 10% of failing messages are subject to quarantine or rejection while the remaining 90% are delivered normally. Increase gradually as you gain confidence in your authentication setup. The default is 100.

How to Publish Your DMARC Record

After generating your record with this tool, log in to your DNS provider and create a new TXT record with these values:

  • Name / Host: _dmarc (the full hostname becomes _dmarc.yourdomain.com)
  • Value: the DMARC string starting with v=DMARC1
  • TTL: 3600 seconds (1 hour) is a sensible default

Allow up to 48 hours for DNS propagation. You can verify your record is live by running dig TXT _dmarc.yourdomain.com or using any online DNS lookup tool.

Prerequisites Before Enabling DMARC

DMARC enforcement is only effective when at least one of SPF or DKIM is already correctly configured for your domain. Before setting p=quarantine or p=reject, make sure:

  • Your SPF record lists all servers that send mail on behalf of your domain — including third-party services such as marketing platforms, CRMs, and support tools.
  • DKIM signing is enabled for all sending services, and the DKIM d= value aligns with your From domain.
  • You have reviewed at least two to four weeks of aggregate reports under p=none to confirm no legitimate sources are failing authentication.

Frequently Asked Questions

Is the DMARC Record Generator free?

Yes, DMARC Record Generator is totally free :)

Can I use the DMARC Record Generator offline?

Yes, you can install the webapp as PWA.

Is it safe to use DMARC Record Generator?

Yes, any data related to DMARC Record Generator only stored in your browser (if storage required). You can simply clear browser cache to clear all the stored data. We do not store any data on server.

What is a DMARC record?

DMARC (Domain-based Message Authentication, Reporting and Conformance) is a DNS TXT record that tells receiving mail servers what to do when an email fails SPF or DKIM authentication checks. It can instruct receivers to deliver, quarantine, or reject failing messages, and can send aggregate or forensic reports back to the domain owner.

How does this DMARC Record Generator work?

Select your enforcement policy, alignment modes, and optional reporting addresses. The tool assembles a standards-compliant DMARC TXT record (RFC 7489) that you can copy and publish in your DNS as a TXT record at _dmarc.yourdomain.com. It only includes tags that differ from the RFC defaults to keep the record concise.

What is the difference between the none, quarantine, and reject policies?

"none" takes no enforcement action — messages are delivered normally regardless of authentication result, but reports are still sent if configured. "quarantine" instructs receivers to treat failing messages as suspicious, typically routing them to the spam folder. "reject" tells receivers to outright reject failing messages during the SMTP transaction. Start with "none" to monitor, then gradually move to "quarantine" and finally "reject" once you are confident all legitimate senders pass authentication.

What is the difference between relaxed and strict alignment?

DMARC alignment compares the domain in the From header against the domain authenticated by SPF or DKIM. Relaxed alignment (the default) allows subdomains — e.g. mail.example.com aligns with example.com. Strict alignment requires an exact domain match. Use relaxed alignment unless you need to prevent subdomain impersonation.

What are rua and ruf addresses?

rua (aggregate URI) receives daily XML reports summarising all mail that claims to come from your domain and whether it passed authentication — these are low-volume and safe to enable on any address. ruf (forensic URI) receives a separate report for each individual failing message, which may contain message headers or body snippets; many receivers no longer send ruf reports for privacy reasons.

Where do I publish the DMARC record in DNS?

Create a TXT record at the subdomain _dmarc.yourdomain.com (note the leading underscore). For example, to protect example.com, the record is at _dmarc.example.com. The record value is the entire DMARC string starting with v=DMARC1. Allow up to 48 hours for DNS propagation before testing.