Skip to content
Emails.help Emails.help — home
Providers
Gmail Outlook.com Yahoo Mail Proton Mail iCloud Mail Zoho Mail Fastmail AOL Mail
Guides
Getting Started Server Settings Security & Access Troubleshooting
Email security hub Email service status
Free tools
Email Signature Generator Gmail Search Builder Outlook Search Builder Email Settings Finder SPF, DKIM & DMARC Checker SPF Record Checker DMARC Record Checker DKIM Record Checker SPF Record Generator DMARC Record Generator DMARC Report Analyzer MX Lookup Email Header Analyzer Is This Email Real?

Free tool · DMARC record generator

DMARC Record Generator

Choose how receivers should treat mail that fails authentication, add where reports should go, and get the exact DMARC record to publish — following the current standard, RFC 9989. Everything runs in your browser.

Used to show where to publish the record and to check report addresses at other domains.

Policy for mail that fails

Daily summaries of who sent mail as your domain and whether it passed. Separate several addresses with commas. Use a mailbox you’ll actually read, or a DMARC reporting service.

What a DMARC record does

DMARC tells receiving servers what to do with mail that claims to come from your domain but fails authentication, and where to send reports about it. A message passes DMARC when SPF or DKIM passes for a domain that matches the From address people see. DMARC is defined by RFC 9989 (May 2026), which replaced RFC 7489.

How to publish your DMARC record

  1. Make sure SPF and DKIM are already set up for every service that sends as your domain — check with the SPF, DKIM & DMARC checker.
  2. Copy the record above.
  3. In your DNS, add a TXT record with the host _dmarc (some DNS panels want the full name, _dmarc.example.com).
  4. Wait for DNS to update, then run the DMARC checker.

The safe rollout: none → quarantine → reject

  1. Start with p=none and an rua address. Nothing changes for your mail; the reports show every service sending as your domain and whether it passes.
  2. Fix what fails — add missing senders to SPF and turn on DKIM for each one.
  3. Move to p=quarantine, optionally with t=y first, when your own mail passes consistently.
  4. Finish with p=reject. Forged mail is refused.

Gmail and Yahoo require bulk senders to publish DMARC; p=none meets that requirement, but only quarantine and reject actually stop spoofing.

What changed with RFC 9989

  • pct was removed. Use t=y to test a stricter policy instead.
  • np was added — a policy for subdomains that don’t exist, a favourite of spammers.
  • ri and rf were removed because receivers ignored them. This generator never adds them.

Questions

What DMARC policy should I start with?

p=none with an rua report address. It changes nothing for your mail while the reports show who sends as your domain. Move to quarantine, then reject, once your own mail passes.

Where do I add the DMARC record?

As a TXT record at _dmarc on your domain — for example _dmarc.example.com — wherever your DNS is managed.

Can my DMARC reports go to another domain?

Yes, but the receiving domain must authorise it by publishing “v=DMARC1” at yourdomain._report._dmarc.theirdomain. DMARC reporting services set this up for their customers.

What does t=y do?

It’s RFC 9989’s test mode: receivers apply one level less than your policy, so quarantine is treated like none and reject like quarantine. Receivers on the older standard ignore it.

Is pct still supported?

RFC 9989 removed pct. Receivers that still follow the older standard may read it, but new records should use t=y instead.

Is this generator free and private?

Yes. The record is built in your browser — nothing you enter is sent to our server.

Sources

More free tools

Check something else

Is This Email Real? → Check a sender against what the company publishes. Email Signature Generator → A professional signature for Gmail and Outlook. Gmail Search Builder → Find any email by sender, date, size or attachment. Outlook Search Builder → Find any email in Outlook or Outlook.com. SPF, DKIM & DMARC Checker → Is the domain’s email authentication set up? MX Lookup → Which servers receive mail for a domain. SPF Record Generator → Build a valid SPF record for your domain. DMARC Report Analyzer → See who sends as your domain, from your DMARC reports. Email Header Analyzer → Trace a message and check who really sent it. Email Settings Finder → IMAP, POP3 and SMTP settings for any address.

Guides

Google Workspace setup guide → SPF, DKIM and DMARC, step by step. Microsoft 365 setup guide → SPF, both DKIM CNAMEs and a DMARC rollout.