DMARC record generator
DMARC tells other mail servers what to do with email that pretends to come from your domain, and sends you reports about it. Choose your settings to get a record you can paste into your DNS.
The safe way to roll out DMARC
- Set up SPF and DKIM for every service that sends as your domain. DMARC passes only if one of them passes and matches your From domain.
- Start with
p=noneand a report address. Nothing changes for your email; you just get daily reports. - Read the reports for a few weeks. Look for real email that fails, and fix it.
- Move to
p=quarantine, thenp=reject, once everything legitimate passes.
Since 2024, Gmail and Yahoo require bulk senders to have at least a p=none DMARC record.
What each part means
| Tag | Meaning |
|---|---|
v=DMARC1 | Marks this as a DMARC record. Always first. |
p= | The policy: none, quarantine or reject |
rua= | Where daily summary (aggregate) reports are sent |
ruf= | Where reports about individual failures are sent. Few providers send these. |
pct= | The share of failing mail the policy applies to. It was dropped from the updated DMARC standard (RFC 9989, May 2026), which uses a t=y testing flag instead, but many receivers still honor pct for now. |
sp= | A separate policy for subdomains |
adkim=, aspf= | Relaxed (r) lets subdomains match; strict (s) requires an exact domain match |
Reading the reports
Aggregate reports arrive as zipped XML files, one per provider per day. They are hard to read by hand, so many people send them to a free or paid DMARC report service, or to a dedicated mailbox they check occasionally. If your report address is on a different domain from the one you're protecting, that domain must publish a record allowing it to receive reports.
See also: Seeing "DMARC policy not enabled"? Here is how to fix it.
What the DMARC record generator does
A DMARC record tells other mail servers what to do with email that pretends to come from your domain, and where to send reports about it. Writing one by hand means remembering tags and getting the punctuation right. This generator builds the record from a few simple choices and shows you exactly what to paste into your DNS.
Benefits
- Pick a policy in plain wordsChoose none to monitor, quarantine to send failures to spam, or reject to refuse them.
- Updates as you typeThe record rebuilds every time you change a setting, so you can see the effect of each choice right away.
- Ready-to-paste DNS detailsYou get the record type (TXT), the host name (_dmarc) and the full value, with a copy button.
- Advanced options when you need themSet the pct share, a separate subdomain policy, strict or relaxed DKIM and SPF alignment, and an optional failure report address.
- Keeps the record tidyTags you don't need are left out. For example, pct is only added when your policy is quarantine or reject and below 100%.
- Helpful warningsIt flags a missing or badly formatted report address and reminds you that reject is the strictest setting.
- Safe default to startIt opens on p=none, which turns on reports without changing how your email is delivered.
Who it is for
- Small-business owners who need a DMARC record to meet Gmail and Yahoo sender rules.
- Web designers and freelancers setting up email for a client's domain.
- Office managers who were asked by their email provider or IT person to add DMARC.
- Marketers preparing a domain for newsletters or cold outreach.
- Anyone moving from p=none to quarantine or reject who wants the new record written correctly.
How to use it
- Choose a policy. Start with none if you're not sure.
- Enter the email address where you want daily reports sent.
- Open Advanced settings only if you need subdomain, alignment or pct options.
- Copy the record and add it as a TXT record named _dmarc at your DNS host.
Your privacy
The record is built entirely in your browser. Your settings and report addresses are not sent to ListaFix or anyone else, and the tool makes no DNS lookups.
Questions people ask
- Where does the DMARC record go?
- In a TXT record with the host
_dmarc, on the domain you send from. - Will p=none hurt my email?
- No. It only turns on reporting. It changes nothing about how your email is delivered.
- How long until DMARC works?
- Usually a few minutes to an hour after you save the record, depending on your DNS host. Check it with the DMARC checker.