DMARC Generator
Build a correct DMARC record without memorising the syntax. Start at monitoring, publish it, and tighten the policy as your reports come in.
How to roll out DMARC without breaking your mail
The generator defaults are deliberate: p=none with an rua address. That record changes nothing about delivery — it only asks every major receiver to send you a daily report of who is sending mail as your domain and whether it passes. Publish it and wait. Most domains discover at least one forgotten sender in the first week: an old website contact form, a marketing tool from two years ago, an invoicing app.
Fix those senders' SPF and DKIM until the reports show everything legitimate passing. Then regenerate the record at p=quarantine — optionally with pct=25, then 50, then 100 over a few days if you are cautious — and finally p=reject. Each step is one TXT edit. The whole journey typically takes two to six weeks, most of it waiting for reports.
One warning about the rua address: reports arrive as XML attachments, daily, from every large receiver. Send them to a dedicated mailbox, not a person's inbox — and if reading XML sounds miserable, that parsing is exactly what UptimeVitals does with them automatically.
DMARC Generator — frequently asked questions
Where exactly do I paste this record?
In your DNS provider's panel (Cloudflare, your registrar, or cPanel's Zone Editor), add a TXT record with the host set to _dmarc and the generated string as the value. Not at the root domain — the underscore name is where receivers look.
Can I have two DMARC records while testing?
No. Like SPF, a domain must have exactly one DMARC record; two records invalidate both. Edit the existing record instead of adding a second.
Should I start at p=reject to be safe?
Only if you are certain every sender is already aligned. Reject with an undiscovered sender still failing means that sender's mail — often invoices or notifications — gets refused outright. The monitoring phase exists to find them first.
What does relaxed vs strict alignment mean?
Relaxed (the default) lets a subdomain of your domain pass alignment — mail from mail.yourdomain.com can authenticate for yourdomain.com. Strict requires an exact domain match. Relaxed is right for almost everyone.