Run a free audit →

Free tool · No account

DMARC Record Generator — enforce, don't just publish.

SPF and DKIM are published, and someone is still sending as your domain. DMARC is the record that tells Gmail, Outlook and Yahoo exactly what to do when a message fails both. Build one with a real rollout plan, not just p=none forever.

  • No account needed
  • Safe none → quarantine → reject rollout built in
  • Compares against your live DNS
1. What should happen to mail that fails?
2. Aggregate reports (rua) — where daily pass/fail summaries go
Forensic reports (ruf) — optional, per-message failure detail
3. Rollout percentage
100%

Applies the policy to only this share of failing mail. Leave at 100% unless you're gradually rolling out enforcement.

Advanced — alignment mode

Relaxed (default) allows subdomain matches, e.g. mail.yourdomain.com aligns with yourdomain.com. Strict requires an exact match.

Your DMARC record
v=DMARC1; p=none
⚠ No rua address set — you'll get zero visibility into who is passing or failing DMARC on your domain. Nearly every DMARC rollout starts by adding one.
⚠ p=none with no reporting address does nothing but exist in DNS. Add an rua address to actually start monitoring.
How to publish this
  1. Go to your DNS provider
  2. Add a TXT record at host _dmarc (e.g. _dmarc.yourdomain.com)
  3. Paste the record above as the value
  4. Start at p=none, read your aggregate reports for 1-2 weeks, then move to quarantine and finally reject
Compare against your live record

How this works

DMARC, in plain English.

What is DMARC actually for?

SPF and DKIM each verify one thing, but neither tells a mailbox provider what to do when a check fails, or whether the "From" address a human sees actually matches what was verified. DMARC adds that missing policy layer, plus a reporting channel so you can see who is sending mail as your domain — including attackers.

Why start with p=none?

p=none takes no enforcement action — it only turns on reporting. That lets you see, via aggregate reports, every legitimate source currently sending as your domain before you risk blocking any of it. Jumping straight to reject is how real marketing or support tool mail gets silently dropped.

What are aggregate reports (rua)?

Daily XML summaries most major mailbox providers send to your rua address, listing every sending source seen, and whether it passed SPF/DKIM alignment. Most teams pipe these into a parser or a tool like Brain rather than reading raw XML by hand.

Does DMARC alignment work differently from a plain SPF/DKIM pass?

Yes — alignment additionally requires the domain in SPF or DKIM to match the visible From address (exactly, in strict mode; or same organizational domain, in relaxed mode). A message can pass SPF and DKIM individually and still fail DMARC if neither one aligns with the From header.

Shortlisting tools?

See what a real diagnosis looks like.

Three causes hid behind one Gmail crisis. Read the full walkthrough, then run the same audit on your own domain.

Run a free audit →