DMARC Record Generator
Answer a few simple questions and get a ready-to-use DMARC record for your domain.
Step 1 of 5
What domain do you want to protect?
This is the domain in your email's "From" address -- the one people see when you send them email. For example, if you send from hello@yourcompany.com, enter yourcompany.com.
What should happen to emails that fail authentication?
This controls how receiving servers (Gmail, Outlook, etc.) handle emails that don't pass SPF or DKIM checks for your domain. If someone spoofs your domain or you have an unauthenticated sender, this is what happens to those emails.
Recommended to start
Monitor Only
Emails are delivered normally even if they fail authentication, but you receive daily reports showing who's sending email as your domain. Start here if this is your first DMARC record. This lets you see what's happening without risking any disruption to your legitimate email. You can always upgrade your policy later once you've reviewed your reports.
Send to Spam
Emails that fail authentication go to the recipient's spam folder instead of their inbox. Use this after you've monitored for 2-4 weeks and confirmed all your legitimate senders (marketing tools, CRM, support desk, etc.) are properly authenticated with SPF and DKIM.
Strongest protection
Block Completely
Emails that fail authentication are rejected outright -- they never reach the inbox or spam folder. This is the strongest protection against spoofing and phishing. Only use this after successfully running quarantine and confirming zero legitimate email is being caught.
Where should DMARC reports be sent?
You'll receive daily aggregate reports from mailbox providers (Google, Microsoft, Yahoo, etc.) showing who is sending email using your domain and whether they pass authentication. These reports arrive as XML file attachments -- you can upload them to our free DMARC Report Analyzer to understand them instantly. No need to pay for expensive DMARC monitoring tools.
💡 Tip: Use a dedicated email address like dmarc-reports@ or dmarc@ for these reports -- they can be frequent (one per day from each major provider). If you use your main inbox, create an email filter to automatically label and archive DMARC reports so they don't clutter your inbox. Filter by subject containing "Report domain" or from addresses like noreply-dmarc@google.com.
📨 What happens after you set this up: Within 24-48 hours, you'll start receiving aggregate report emails from providers like Google, Microsoft, and Yahoo. Each email contains an XML attachment with data about who sent email using your domain and whether it passed SPF and DKIM checks. Upload these files to our free DMARC Report Analyzer to see a clear breakdown -- no paid tools required.
Should subdomains follow the same rules?
This decides what happens to emails sent from subdomains like mail.example.com or news.example.com. If you don't use subdomains to send email, the safe choice is to keep them on the same policy.
Recommended
Yes, same policy
Subdomains inherit the same authentication policy you chose above. This means if someone tries to spoof anything.yourdomain.com, it gets the same treatment. This is the safest option for most setups, especially if you don't send email from subdomains.
No, treat them differently
Set a separate, usually more lenient policy for subdomains. Useful if you send email from subdomains (like marketing.example.com) that aren't fully authenticated yet. This lets you enforce a strict policy on your main domain while giving subdomains time to catch up.
How strict should the authentication checks be?
This controls whether the domain in your SPF and DKIM records needs to exactly match your From address, or if subdomains are also accepted as a match. This is a technical setting -- if you're unsure, go with Relaxed.
Recommended
Relaxed
Accepts authentication from your domain and its subdomains. For example, if your From address is you@example.com, an SPF record on mail.example.com would still count as a pass. This works with most email setups out of the box, including services like Google Workspace, Microsoft 365, Mailchimp, and SendGrid.
Advanced
Strict
Requires an exact domain match -- mail.example.com would not pass for example.com. This provides stronger protection but may cause legitimate email to fail if your SPF or DKIM uses subdomains (which many email services do by default). Only choose this if you've verified your setup.
🔐
Your DMARC record is ready
Enter your email to see your record and get setup instructions. We'll email you a copy, that's it, no marketing emails.
Your record is generated in your browser. We only receive a copy for your reference. No spam, no mailing list, just your record.
Your DMARC Record
Domain: example.com
DNS Record Name
_dmarc.example.com
DNS Record Value
TXT
How to add this to your DNS
- Log in to your DNS provider (GoDaddy, Cloudflare, Namecheap, Route 53, etc.)
- Find the DNS management section for example.com
- Add a new TXT record
- Set the Name/Host to: _dmarc
- Set the Value/Content to the record above
- Set TTL to 3600 (1 hour) or your provider's default
- Save and wait up to 48 hours for propagation
⚠️ Important: You can only have one DMARC record per domain. If you already have one, replace it -- don't add a second.