DMARC Record Generator

Pick a policy, alignment, and reporting setup and get back a valid DMARC record - built against the current DMARC spec (RFC 9989, published 2026), which replaced the old pct= percentage tag with t=y for staged rollouts. Most generators online still emit the deprecated version.

1. Your domain

Only used to check whether your reporting addresses below are on a different domain (which needs an extra authorization record).

2. Policy

none - monitor onlyFailing mail is delivered as normal. Use this first to see what the aggregate reports look like before enforcing anything.

quarantineFailing mail is usually sent to spam. The standard second step once you've reviewed reports under none.

rejectFailing mail is rejected outright. Only move here once quarantine reports show no legitimate mail failing.

Testing mode (t=y)Tells receivers you’re still rolling this out - some will apply a lighter policy on failure instead of the one above. This replaced the old pct= percentage tag in the current DMARC spec (RFC 9989, 2026); turn it off once you trust the policy fully.

3. Subdomains (optional)

Leave both on default unless you specifically need subdomains handled differently from the main domain.

Existing subdomains without their own DMARC record (sp)

Subdomains that don’t exist in DNS at all (np)

4. Alignment (optional)

Relaxed (default) allows a subdomain match, e.g. mail.yourdomain.com authenticating for yourdomain.com. Strict requires an exact match - only use it if you're sure every sender aligns exactly.

DKIM alignment (adkim)

SPF alignment (aspf)

5. Reporting

Aggregate reports (rua) - recommended

Daily summaries of what passed/failed and from where. This is how you'll actually know it's safe to move to quarantine or reject.

Failure reports (ruf) - optional

Per-message reports for individual failures. Most large mailbox providers (Gmail, Yahoo) no longer send these for privacy reasons, so don't rely on it.

Your DMARC record

Needs attention

v=DMARC1; p=none

No reporting address at all - p=none with no rua means DMARC is published but you'll never see the reports that make it useful.

Publish this as a single TXT record at host _dmarc (i.e. _dmarc.yourdomain.com). A domain can only have one DMARC record.

DMARC only works if SPF or DKIM are actually aligned first - jumping to p=reject without checking that can silently drop real mail.

Get a Free Deliverability Review Or book a call directly

How we help: Consulting · Private infrastructure · Managed mailboxes · Monthly support