Pick a policy and where reports should go, and get a ready-to-publish DMARC TXT record with the exact host name. Every tag is explained in plain words, and the tool warns about common mistakes such as missing report addresses or external report domains.
Last updated:
Your DMARC record
Add it to your DNS
Type
TXT
Host / Name
_dmarc _dmarc.example.com
Value
TTL
3600(or your host's default)
What each tag means
Advertisement
Advertisement
How to use the DMARC Record Generator
Enter your domain. The host name for the record (_dmarc.yourdomain) updates automatically.
Choose a policy. Start with p=none to monitor, then move to quarantine and reject once reports show all your real mail passes.
Add a report address (rua) so you receive daily aggregate reports from Gmail, Outlook, Yahoo and others.
Adjust advanced options if needed: subdomain policy, pct rollout, strict alignment and forensic reports.
Copy the TXT record and create it at your DNS host with the host name _dmarc.
DMARC tags reference
Tag
Values
Default
Meaning
v
DMARC1
required
Version; must be the first tag
p
none, quarantine, reject
required
Policy for the domain; must be the second tag
sp
none, quarantine, reject
same as p
Policy for subdomains
pct
0–100
100
Share of failing mail the policy is applied to
rua
mailto: URIs, comma-separated
none
Where aggregate reports go
ruf
mailto: URIs, comma-separated
none
Where failure (forensic) reports go
fo
0, 1, d, s (colon-separated)
0
When to generate failure reports
adkim
r, s
r
DKIM alignment mode: relaxed or strict
aspf
r, s
r
SPF alignment mode: relaxed or strict
ri
seconds
86400
Requested interval between aggregate reports
rf
afrf
afrf
Failure report format (only one is defined, so it is rarely written)
A safe rollout plan
Week 0: publish SPF and enable DKIM signing in every service that sends as your domain.
Weeks 1–4:v=DMARC1; p=none; rua=mailto:…. Read the aggregate reports (a DMARC report service makes them readable) and fix every legitimate source that fails.
Next:p=quarantine; pct=25, then raise pct to 100 while watching reports.
Finally:p=reject. Keep the rua address so you notice new services that someone sets up without SPF or DKIM.
How DMARC passes
A message passes DMARC when at least one of these is true: SPF passes and the Return-Path domain aligns with the From domain, or a DKIM signature verifies and its d= domain aligns with the From domain. With relaxed alignment, mail.example.com aligns with example.com because both share the organizational domain; with strict alignment they must be identical. Forwarded mail often breaks SPF, which is why DKIM is important before you move to reject. You can inspect real results in a message's Authentication-Results header with the Email Header Analyzer.
Frequently asked questions
What is a DMARC record?
DMARC (RFC 7489) is a TXT record published at _dmarc.yourdomain. It tells receiving mail servers how to handle messages whose visible From domain fails authentication (no aligned SPF or DKIM pass), and where to send reports about mail using your domain.
Which DMARC policy should I start with?
Start with p=none and a rua address. This changes nothing for delivery but sends you reports showing every server that sends mail as your domain. Once all legitimate sources pass SPF or DKIM with alignment, move to p=quarantine and then p=reject.
Where do I add the DMARC record?
Create a TXT record with the host or name _dmarc (your DNS host adds the domain, giving _dmarc.example.com) and paste the generated value. Only one DMARC record is allowed per domain.
What is the difference between rua and ruf?
rua receives aggregate reports: daily XML summaries of how many messages each IP sent and whether they passed. ruf receives forensic (failure) reports about individual failing messages; few large providers send them because they may contain personal data.
What does alignment (adkim and aspf) mean?
Alignment checks that the domain verified by SPF or DKIM matches the From domain. Relaxed (r, the default) accepts subdomains of the same organizational domain, such as mail.example.com for example.com. Strict (s) requires an exact match.
Do Gmail and Yahoo require DMARC?
Since February 2024, Gmail and Yahoo require bulk senders (around 5,000 or more messages a day to their users) to publish a DMARC record, at minimum p=none, along with SPF and DKIM. A DMARC record is good practice for every domain that sends email.
Why do I need an extra record for an external report address?
If the rua or ruf address is on a different domain, that domain must agree to receive reports by publishing a TXT record named yourdomain._report._dmarc.theirdomain with the value v=DMARC1. DMARC reporting services usually publish this for you.
Are all the tools on FreeToolCabin tested for quality and accuracy?
Yes! Every tool on our site undergoes automated Q/A testing in real browser environments to ensure high precision, correct output, and zero errors. If you happen to spot a bug or have a suggestion, please contact us at [email protected] and our team will review it right away.