DnsGuard

DnsGuard › Guides › DMARC › Generator

DMARC record generator

A DMARC record tells receiving mail servers what to do with mail that fails SPF and DKIM alignment, and where to send reports. Choose your settings and copy the record into your DNS panel. New to DMARC? Read the DMARC guide first.

Runs entirely in your browser. Nothing you type here is sent to DnsGuard or stored.

Policy
Reports
Advanced: alignment (adkim=, aspf=)

Your DMARC record

Type TXT, name _dmarc.example.com (most DNS panels want just _dmarc), value:

v=DMARC1; p=none

    After you publish it, check your domain to confirm receivers can read it.

    The path to p=reject

    1. Monitor. Publish p=none with a rua= address and read the aggregate reports for two to four weeks.
    2. Fix your senders. Every legitimate service that fails needs SPF or DKIM aligned with your domain. Add it to your SPF record or turn on DKIM signing with your own domain.
    3. Quarantine. Switch to p=quarantine. You can start with pct=25, then 50, then 100.
    4. Reject. Once reports stay clean, switch to p=reject. Domains that never send email can go straight to p=reject.

    How to publish it

    1. In your DNS provider's panel, add a TXT record with the name _dmarc (the panel adds your domain) and paste the value. If a _dmarc TXT record already exists, edit it instead. A domain must have exactly one.
    2. If reports go to an address at another domain, that domain has to publish an authorization record. The generator shows it when you need one; report services usually publish it for you.
    3. Wait for the TTL to pass, then run a check.

    Check your domain now

    Free check of SPF, DKIM, DMARC, BIMI, MX, MTA-STS and TLS-RPT with a 0–100 score and plain-English fixes. No sign-up.

    Free tools: SPF record generator · DMARC record generator