EpiFive
All free tools

DMARC record generator

Choose a policy and where reports should go, and copy a valid DMARC record for the _dmarc TXT record of your domain.

Add a TXT record with host _dmarc (full name _dmarc.yourdomain.com)

v=DMARC1; p=none

  • Add at least one rua address. Without reports you cannot see who sends mail as your domain before you enforce the policy.

How to use it

  1. Start with p=none and a reporting address in rua. This changes nothing for delivery, but you start receiving daily reports of who sends mail as your domain.
  2. After two to four weeks, when every legitimate sender passes SPF or DKIM, move to p=quarantine, optionally with a lower percentage first.
  3. Finish with p=reject, so mail that spoofs your domain is blocked.
  4. Publish the record as a TXT record with host _dmarc. A domain must have only one DMARC record.

What the tags mean

  • p: what receivers do with mail that fails DMARC: none, quarantine or reject.
  • rua: where daily aggregate reports are sent.
  • sp: a separate policy for subdomains.
  • pct: the share of failing mail the policy applies to, for a gradual roll-out.
  • adkim / aspf: relaxed alignment accepts subdomains of the From domain; strict needs an exact match.

Related guides

Questions people ask

Is p=none enough?

No. p=none only monitors. It meets the Gmail and Yahoo bulk sender requirement to have DMARC, but it does not stop anyone spoofing your domain. Move to quarantine and then reject once your reports are clean.

Where should DMARC reports go?

To a mailbox or a DMARC report service. The reports are XML files, so a free report analyser makes them much easier to read. If reports go to another domain, that domain must authorise it with a _report._dmarc record.

Will DMARC break my newsletters?

Only if the newsletter service sends without aligned SPF or DKIM. Set up DKIM for each sending service with your own domain before you move past p=none, and the reports will show anything you missed.

Do I need a DMARC record for subdomains?

No. Subdomains inherit the parent domain’s record, using sp if you set it. Add a separate _dmarc record on a subdomain only if it needs a different policy.