DMARC record generator

Build a correct DMARC TXT record. We'll output the exact value to paste into DNS, plus a short plain-English summary of what each tag does.

Policy (what receivers do with failing mail)

None

Monitor only. Nothing blocked. Start here.

Quarantine

Send failing mail to spam folder.

Reject

Block failing mail entirely. Strongest.

Aggregate reports (rua)

Daily XML report of every server sending as you.

Forensic reports (ruf). Optional

Per-message forensic data. Most receivers ignore this.

Subdomain policy

Staged testing Add t=y (dry run)

DMARCbis (RFC 9989) replaced the old pct= tag with t=y: receivers apply the next-lower policy (p=reject behaves like quarantine, p=quarantine like none) and keep reporting, so a stricter step is staged but not fully enforced yet. Use when escalating.

Alignment

Strict SPF Strict DKIM

Example result for example.com

Sample data. Run the check above to see yours.

Your DMARC record

Generated

Publish as a TXT record at _dmarc.example.com.

_dmarc.example.com TXT

v=DMARC1; p=none; rua=mailto:dmarc@example.com; fo=1

Frequently asked questions

What policy should I start with?

Start at p=none. It tells receivers to take no action but still send you aggregate reports, so you can see every sender for a couple of weeks before you enforce. Move to p=quarantine, then p=reject, once your legitimate senders are aligned.

Where do I publish the DMARC record?

As a DNS TXT record at the host _dmarc.yourdomain.com, with the generated string as the value. Add it in your DNS provider, wait for propagation, then confirm it with the DMARC checker.

Do I need SPF and DKIM before DMARC?

Yes. DMARC only acts on SPF and DKIM results, so publish and align those first. A starter DMARC record at p=none is safe to publish immediately because it changes nothing about delivery while you collect reports.

Should the generated record use a generator or a domain scan?

A generator builds a record from the options you pick. For the exact record tailored to your live DNS and senders, plus a guided rollout, scan your domain instead and PhishFence recommends the record for you.

Want ongoing monitoring?

This tool is a one-shot check. PhishFence watches your domain with automated hourly monitoring (daily on Free) for DMARC changes, new lookalike registrations, and spoofing attempts.

Start free monitoring