Free DMARC Generator: Load Your Current Record

Generate your record

Choose a rollout policy, tell mailbox providers where to send reports, and the generator assembles the record. The policy tags it suggests are safe by default — it warns you before you lock in anything aggressive.

Record ready? Have a specialist double-check it — the $49 Email Domain Trust Audit is a fixed-output report with risk notes and prioritized next steps.

After you publish

Publish it as a TXT record at _dmarc + your domain (for example _dmarc.example.com) — not at the domain root. DMARC is the one email-authentication record that does not live on the bare domain.
Wait, then read your rua reports — the first daily aggregate shows every IP sending as your domain. Confirm your real senders pass before tightening the policy.
Roll the policy up the ladder — p=none → p=quarantine → p=reject, one step every week or two, watching the reports between steps.
Check the whole stool — DMARC only works when SPF or DKIM pass. Run the free domain trust check to confirm SPF, DMARC, DKIM, and MX all agree:

Publish it at your DNS provider

The record is the same everywhere: a TXT record at _dmarc + your domain (for example _dmarc.example.com), pasting the value from the generator. Only the buttons differ. Three common providers:

Cloudflare — Dashboard, your domain, DNS, Records, Add record. Type: TXT. Name: _dmarc. Content: paste the generated record. TTL: Auto. Save.

GoDaddy — My Products, DNS next to your domain, Add. Type: TXT. Host: _dmarc. TXT Value: paste the generated record. Leave the TTL default. Save.

Amazon Route 53 — Hosted zones, your domain, Create record. Record name: _dmarc. Record type: TXT. Value: paste the generated record inside double quotes (Route 53 requires them). Save.

Then confirm it is actually live: DNS changes can take minutes to hours to propagate. Run the Free DMARC Record Checker to confirm the policy parses, then the Free Email Domain Trust Checker to see your DMARC line read pass.

Complete the authentication set

Email authentication needs all three records working together. Generate the rest of the set, free, in your browser:

Prefer done-for-you?

If you'd rather hand this to a specialist, submit your domain for the Email Domain Trust Audit — a fixed-output report with risk notes and prioritized next steps. When records are broken and you want them fixed, the 99 Mailbox Rescue gets them fixed within 48 hours, zero tech touch.

Frequently asked questions

What does a DMARC record do? A DMARC record tells receiving mail servers what to do with messages that fail SPF and DKIM checks — nothing, quarantine them, or reject them. It also tells providers where to send aggregate and forensic reports, so you can see who is sending mail as your domain, including impersonators.

Where do I publish the DMARC record? Publish it as a DNS TXT record at the _dmarc subdomain of your domain (for example _dmarc.example.com), not at the domain root. DNS changes can take minutes to hours to propagate.

Should I start with p=none, p=quarantine, or p=reject? Start with p=none: you receive reports but nothing is blocked, so you can discover every legitimate sender first. Once the reports confirm your senders pass SPF or DKIM, step up to p=quarantine, then p=reject. Jumping straight to p=reject risks silently dropping real mail from senders you forgot.

What are rua and ruf reports? The rua address receives aggregate reports — daily XML summaries from every major provider showing which IPs sent as your domain and whether they passed. The ruf address receives forensic reports with per-message details for individual failures, useful for debugging a specific sender.

What is the difference between relaxed and strict alignment? Relaxed alignment accepts a subdomain of your domain in SPF or DKIM as a pass; strict alignment requires the exact domain to match. Relaxed is the safe default — strict only once you know every sender signs or sends from the exact domain.

Build a Valid DMARC Record in 30 Seconds