DMARC Record Generator
Create a DMARC record that's right for where you are in the roll-out. Pick a policy, decide how subdomains are treated, add report addresses, and copy the exact record to publish at _dmarc.
DMARC Record Generator
Alignment, reporting and testing options
Load current record asks Cloudflare's public DNS-over-HTTPS resolver (1.1.1.1) straight from your browser. Nothing passes through ToolFeather. Building the record itself happens on this page, with no network at all.
Queries your browser sent (0)
These are the exact requests, each one a link. Open one to see the raw JSON answer from the resolver.
The record is built on this page. Load current record asks Cloudflare DNS directly from your browser.
Scratchpad auto-saved
How it works — in four simple steps
No signup and nothing to install — it all runs in your browser.
Enter your domain
Or load its current record.
Choose the policy
Start with none, finish at reject.
Add a report address
A mailbox you read, or a DMARC report service.
Publish and verify
Add the TXT record at _dmarc, then run the DMARC checker.
Collect rua reports for a few weeks before moving past p=none. They show every service sending as you.
Features
Every RFC 9989 tag
p, sp, np, rua, ruf, adkim, aspf, fo, t, plus legacy pct when you need it.
Roll-out guidance
Advice for the monitor, quarantine and reject stages, and what testing mode really does.
Report checks
Validates addresses and explains the authorisation record needed for reports sent to another domain.
Load the live record
Fill the form from the domain's current DMARC record and edit from there.
Publish-ready output
Type, host and value, plus a zone-file line.
About the DMARC Record Generator
A DMARC record is a TXT record at _dmarc.yourdomain. It always starts v=DMARC1, followed by the policy p=. Everything else is optional, but rua= is the tag you really want: it's where receivers like Gmail, Yahoo and Microsoft send daily aggregate reports listing every server that sent mail as your domain and whether it passed. Those reports are what let you tighten the policy without blocking your own email.
Roll it out in stages. Begin with p=none and watch the reports for two to four weeks while you fix SPF and DKIM for each legitimate sender. Then go to p=quarantine, and finally p=reject. RFC 9989 adds t=y for this: receivers apply the next-weaker policy (reject is treated as quarantine, quarantine as none) while you test. It replaces the old pct sampling, which updated receivers now ignore. The generator can still add pct for older receivers if you need it.
sp= sets the policy for existing subdomains, and the new np= covers subdomains that don't exist at all, the made-up names phishers like (invoices.yourdomain.com). adkim and aspf choose relaxed alignment (the default: any subdomain of your domain counts) or strict (exact match only). Everything is built on this page. Load current record makes a single DNS query from your browser to fill the form with what's live.