DMARC Record Generator — Create a Valid DMARC Record

Q: What is the simplest valid DMARC record?

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com. It changes nothing for your mail and sends you daily reports, which you need before choosing a stricter policy.

Q: Is pct= still used?

No: RFC 9989, which replaced RFC 7489 in May 2026, removed pct=. To try a stricter policy, add t=y (test mode): receivers then apply one step less. Receivers that still follow RFC 7489 ignore t=y and apply the policy as written, so step up one level at a time.

Build a DMARC record and copy it into your DNS.

Domain

For the host name and the report checks. "Start from my current record" reads the record published now.

Where are you on the path to full protection?

Move one step at a time, after a few weeks of clean reports. Steps 2 and 4 use test mode: receivers apply one step less.

Policy (p) Start with none; tighten after reading reports Subdomains (sp) Subdomains that don't exist (np) RFC 9989; reject stops spoofing of made-up subdomains Aggregate reports to (rua) One or more addresses, separated by commas. Strongly recommended Failure reports to (ruf) Rarely sent by receivers, and they can contain parts of real messages DKIM alignment (adkim) SPF alignment (aspf) Test mode (t=y): receivers apply one step less, to try a stricter policy safely

Your DMARC record

TypeTXT

Name_dmarcmost DNS panels add the domain

Full name_dmarc.yourdomain.com

Valuev=DMARC1; p=none

Zone file_dmarc.yourdomain.com. 3600 IN TXT "v=DMARC1; p=none"

Check it once published →

A DMARC record generator builds the TXT record that tells receivers what to do with mail that fails SPF and DKIM, and where to send reports. Publish it at _dmarc on your domain.

How to Publish Your DMARC Record

Add one TXT record named _dmarc with the value above, then check it.

Open the DNS settings at your DNS host (where your domain's name servers point: the NS lookup tells you).
Add a TXT record with the name and value above.
Replace any existing v=DMARC1 record at _dmarc: two records make receivers ignore DMARC.
Wait for the TTL (often an hour), then run the DMARC checker.
Read the reports for a few weeks before moving to the next step (the safe path to p=reject).

DNS host	Name field	Value field
Cloudflare	`_dmarc`	The value as shown, without quotes
GoDaddy	`_dmarc`	The value as shown, without quotes
Namecheap	`_dmarc`	The value as shown, without quotes
Amazon Route 53	`_dmarc`	In double quotes (`"v=DMARC1; …"`); over 255 characters, split it like the zone file line
Your own DNS server (BIND, PowerDNS…)	The zone file line above

For a subdomain such as mail.example.com, the name is _dmarc.mail in the example.com zone.

DMARC Tags, Briefly

Tag	What it does	Default
`v=DMARC1`	Version; must come first, written exactly like this	required
`p=`	Policy for the domain: none, quarantine or reject	required
`sp=`	Policy for subdomains	same as p
`np=`	Policy for subdomains that don't exist (RFC 9989)	sp, then p
`rua=`	Addresses for daily aggregate reports	no reports
`ruf=` · `fo=`	Addresses for failure reports, and when to send them	none · 0
`adkim=` · `aspf=`	How exactly the DKIM / SPF domain must match the From domain	r (relaxed)
`t=`	Test mode: y applies one step less (replaces pct= in RFC 9989)	n
`pct=` · `ri=` · `rf=`	Removed by RFC 9989 (May 2026): leave them out	—

Built in your browser: nothing you type is sent to us. "Start from my current record" asks our server to read the public DNS record of the domain, like the DMARC checker. Last verified 12 November 2026.

Frequently Asked Questions

How do I create a DMARC record?

Choose a policy and a report address above, copy the record, and add it in your DNS provider as a TXT record with the name _dmarc (or _dmarc.yourdomain.com if the panel wants the full name). Then check it with the DMARC checker.

What is the simplest valid DMARC record?

v=DMARC1; p=none; rua=mailto:[email protected]. It changes nothing for your mail and sends you daily reports, which you need before choosing a stricter policy.

Can I edit the DMARC record I already have?

Yes. Type your domain and click "Start from my current record": the form fills in from the record published now, and a list shows exactly what your new record changes. Tags that no longer exist in DMARC (pct, ri, rf) are dropped and explained.

Is pct= still used?

No: RFC 9989, which replaced RFC 7489 in May 2026, removed pct=. To try a stricter policy, add t=y (test mode): receivers then apply one step less. Receivers that still follow RFC 7489 ignore t=y and apply the policy as written, so step up one level at a time.

Can I send DMARC reports to another domain?

Yes, but the receiving domain must agree by publishing a TXT record yourdomain._report._dmarc.theirdomain with v=DMARC1 (RFC 9990). Report services set this up for their customers.

Put this guide into practice

Related Tools

DMARC Checker

Check the published record and read your reports.

SPF Record Checker

Make sure your senders pass SPF before tightening DMARC.

DKIM Checker

Make sure your senders sign with DKIM.