# DMARC Record Generator: Build a DMARC Record

URL: https://email-validation.org/tools/dmarc-generator/
Updated: 2026-11-06

> Documentation index: https://email-validation.org/llms.txt

Choose a policy, add the addresses that should receive reports and pick the alignment mode. The record updates as you
type, with notes on anything that weakens it, following [RFC 7489](https://www.rfc-editor.org/rfc/rfc7489).
Everything runs in your browser.

## Publish it

1. In your DNS host, add a **TXT** record with the host `_dmarc` (some hosts want the full name,
   `_dmarc.example.com`) and the record as its value.
2. Keep only one DMARC record on that name: with two, receivers apply neither.
3. Check it with our [DMARC checker](https://email-validation.org/tools/dmarc-checker/) once the old TTL has passed.

DMARC needs SPF or DKIM to pass on your own domain first; set those up with the [SPF generator](https://email-validation.org/tools/spf-generator/)
and your mail provider's DKIM instructions.

## Choosing the policy

- **`p=none`** — receivers only report. Start here: it changes nothing for your mail and shows you every source that
  sends as your domain. It also meets the Gmail and Yahoo minimum for bulk senders.
- **`p=quarantine`** — failing mail goes to the spam folder. Move here when the reports show that all your own mail
  passes.
- **`p=reject`** — failing mail is refused. The goal: the strongest protection against spoofing, and a requirement
  (with quarantine) for BIMI logos.

`pct=` applies the policy to a share of failing mail only, which lets you move from none to quarantine in steps.
Remove it (or set 100) when you are done.

## Reports

`rua=` addresses receive aggregate reports: one XML file per receiver per day, listing the sending IPs, message counts
and SPF/DKIM results. They contain no message content. Use a mailbox you read, or a DMARC report service that turns
the XML into charts. If the address is on another domain, that domain must authorise it with a TXT record at
`<your domain>._report._dmarc.<their domain>` ([RFC 7489 §7.1](https://www.rfc-editor.org/rfc/rfc7489#section-7.1));
report services do this for you.

`ruf=` asks for failure reports about single messages. Few large providers send them, and they can include parts of
the message, so leave it out unless you need it.

## Alignment

Relaxed alignment (`r`, the default) accepts a subdomain: mail with From `example.com` passes on DKIM signed by
`mail.example.com`. Strict alignment (`s`) needs the exact domain. Keep relaxed unless you have a reason; strict
breaks mail from services that sign or bounce on a subdomain of yours.

Checking email addresses rather than domains? Try our [free email checker](https://email-validation.org/email-checker/) or see [pricing](https://email-validation.org/pricing/) for lists and the API.

## Frequently asked questions

### Which DMARC policy should I start with?

Start with p=none and a rua= report address. Read the reports for a few weeks, fix SPF or DKIM for every legitimate sender, then move to quarantine and reject.

### What is the host name of a DMARC record?

A TXT record at _dmarc under your domain, for example _dmarc.example.com. In most DNS panels you enter _dmarc as the host.

### Do DMARC reports contain my emails?

Aggregate (rua) reports do not: they list sending IP addresses, message counts and authentication results. Failure (ruf) reports can include message details, which is why few providers send them.