DMARC recordgenerator.
Create a DMARC record with the right policy and an address for reports, with a plain-English note on every part of it.
How it works
- Choose a policyStart with monitoring
- Add a report addressTo see who sends as you
- Publish at _dmarcOne TXT record
Free, no sign-up. Runs in your browser. Nothing you type is sent anywhere.
The tool
Your policy
Start at none, read the reports for two weeks, then tighten.
Daily summaries of who sends as you. Use an inbox you read, or a DMARC report service.
Your DMARC record
Add it as a TXT record on the host _dmarc (so: _dmarc.yourcompany.com).
v=DMARC1; p=none
What each part means
- v=DMARC1
- The version. Always first.
- p=
- What receivers do with mail that fails: nothing, spam folder, or reject.
- rua=
- Where daily reports go. This is where you learn who sends as you.
- sp=
- The same choice for subdomains.
- pct=
- The share of failing mail the policy applies to, for a careful rollout.
- adkim / aspf
- Relaxed lets subdomains match; strict needs the exact domain.
Rolling out DMARC safely.
What the result means, and how to fix what it finds.
What DMARC does
DMARC tells receiving servers what to do with email that claims to be from your domain but fails authentication: deliver it anyway, send it to spam, or reject it. It also asks them to send you daily reports showing every server that sent email as your domain, which is how you find a forgotten service or someone spoofing you.
Start with p=none
Begin with p=none and a report address. Nothing changes for your email, but the reports start arriving. Read them for a couple of weeks: every service that sends for you should pass SPF or DKIM in line with your domain. A p=none record already meets Google's and Yahoo's rules for bulk senders.
Then tighten
Once everything that's meant to send passes, move to p=quarantine, perhaps applied to part of your mail at first with pct, and later to p=reject. Each step makes spoofing your domain harder. For a domain used only for cold email, quarantine is a sensible place to settle.
Reading the reports
Reports arrive as zipped XML files, which are hard to read by hand. A DMARC report service turns them into a dashboard; several have free plans. Or send them to an inbox you rarely use and look only when something changes. Without the rua tag you get no reports at all.
Alignment, in plain words
DMARC passes only when SPF or DKIM passes for a domain that matches the From address. Relaxed alignment, the default, accepts any subdomain of the same domain; strict alignment needs an exact match. That is why a CRM sending as your domain can pass SPF on its own domain and still fail DMARC: the domains don't line up. The fix is usually to set up DKIM for that service with your domain, or a custom return path. Keep alignment relaxed unless you have a reason not to. The subdomain policy (sp) lets you treat subdomains differently from the main domain, which helps when a subdomain is used for one tool only.
In mailzy
Domains and mailboxes, set up right.
Buy a .com through mailzy and order mailboxes on it: we publish SPF, DKIM and DMARC for you, then warm the mailboxes up.
Questions before you start.
Ask us on the chat if yours isn't here. A real person answers.
Where does the DMARC record go?
In your DNS, as a TXT record on the host _dmarc, so the full name is _dmarc.yourdomain.com.
Will p=reject block my own email?
Only email that fails both SPF and DKIM alignment. That's why you start at p=none and read the reports first.
Do I need DMARC for cold email?
Yes. Gmail and Yahoo require it from bulk senders, and without it your domain is easier to spoof.
More free tools.
Domain Health Checker
One score for a sending domain: SPF, DKIM, DMARC, MX, blocklists and Gmail's and Yahoo's sender rules.
Open the toolSPF Record Generator
Build one valid SPF record from the services you send with, with the 10-lookup limit counted.
Open the toolDKIM Checker
Check that a DKIM key is published, that it parses, and that it's long enough.
Open the toolEverything for cold email, in one place.
Start free for 14 days. No card needed.