FindLeadEmails
Email intelligence
Try it for free
Tool

DMARC record generator

Build a _dmarc TXT record. Start at p=none, then tighten once the reports look clean.

This tool only reads public DNS or runs in your browser. It does not spend verification credits.

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

Publish as TXT at _dmarc.yourdomain.com. Start at p=none until SPF and DKIM pass on real mail.

What this generator is for

DMARC tells receiving servers what to do when SPF or DKIM do not pass for your domain, and where to send aggregate reports. The record lives at _dmarc.yourdomain.com. Getting started is a TXT record with p=none and a mailbox you monitor — not p=reject copied from a Twitter thread.

This page drafts that record. It runs in your browser. No credits.

Policy, in plain language

  • `p=none` — monitor. Mail still delivers according to other signals. You get reports. This is where every domain should start.
  • `p=quarantine` — "treat failures as suspicious" (usually spam). Tighten here when reports show only your real servers are sending.
  • `p=reject` — drop failures. Correct for a mature domain being spoofed. Wrong for a domain you set up yesterday.

pct= can roll out quarantine/reject gradually. rua= is the aggregate report mailbox. ruf= forensic reports are optional and often noisy.

A sane first record

Start at p=none, with rua= pointing at a mailbox or a report processor you actually open. Generate it here, publish the TXT on the _dmarc host, then confirm with the deliverability checker.

Provider-specific click paths: DMARC on Google Workspace and the rest of /dns.

What the reports are for

Aggregate XML (or a summarised dashboard) shows which IPs sent mail claiming to be you, and whether they passed SPF/DKIM. That is how you discover:

  • A forgotten ESP still sending.
  • A spoofing campaign using your domain.
  • A legitimate server you forgot to include in SPF.

Do not jump to p=reject because a vendor's onboarding checklist said "best practice." Read a week of reports first.

DMARC vs verification

DMARC protects *your* domain as a sender. It does nothing to the addresses on your To: line. You still need mailbox verification so you are not hard-bouncing other people's domains while yours is perfectly authenticated.

Related

Related