Free DMARC Record Generator.

Create one TXT record named _dmarc at the company that hosts your domain's DNS and paste the generated value into it. Many DNS panels add your domain to the name automatically, so if the field already shows your domain, do not type it again, or the record lands at _dmarc.yourdomain.com.yourdomain.com. Publish exactly one DMARC record: receivers ignore the set when they find two. Then press Verify Publication to confirm it.

Most domains should start with v=DMARC1; p=none; rua=mailto: followed by an address you read, such as dmarc-reports at your own domain. p=none changes nothing about how your mail is delivered, and the rua address collects aggregate reports showing every server that sends as your domain and whether it passed. An address on another domain only receives reports if that domain publishes an authorisation record for yours.

Yes. DMARC only passes when SPF or DKIM passes for a domain aligned with your From address, so without either one every message fails. You can publish p=none first to see what fails, but fix SPF and DKIM for every service that sends as you before any stricter policy. If you plan to use reject, sign with DKIM: forwarded mail usually breaks SPF but keeps a valid DKIM signature.

They set how strictly receivers should treat mail that fails DMARC. none requests no action and only collects reports. quarantine marks failing mail as suspicious, which usually means the spam folder. reject asks receivers to refuse it during delivery, so it never arrives. Receivers make the final decision. Move from none to quarantine to reject in stages, so a sender you missed shows up in the reports before its mail is blocked.

p=none meets the DMARC part of the bulk sender rules at Gmail, Yahoo and Outlook, but it does not stop anyone spoofing your domain. Receivers apply no policy to failing mail at none, and you only get reports. It is the right place to start and to stay while you find and fix every legitimate sender. Protection begins at quarantine or reject.

The usual reasons are that the record has no rua address, the record is not published at _dmarc yet, the report address is on another domain that has not authorised reports for yours, or receivers have not sent any yet. A domain that accepts reports for another must publish a TXT record named yourdomain._report._dmarc.theirdomain containing v=DMARC1, or receivers drop the reports. Aggregate reports usually cover a day each. The checker tests the first three.

Yes, for bulk senders. Gmail and Outlook require SPF, DKIM and a DMARC record from anyone sending more than 5,000 messages a day to their users, and p=none is allowed. Yahoo requires bulk senders to publish a valid DMARC policy of at least p=none that passes, with relaxed alignment accepted. All three require the From domain to align with SPF or DKIM.

Yes. A record on your main domain also applies to subdomains that do not publish their own. sp sets a different policy for subdomains that exist, np sets one for subdomains that do not exist, and with neither, p applies everywhere. np comes from the 2026 update to the standard, so older receivers ignore it. A subdomain can publish its own _dmarc record, which then takes priority. The checker shows which record covers a domain.

It works as soon as your DNS host publishes it, though caches can delay when receivers see it. If someone looked up the name before the record existed, resolvers may keep that empty answer for up to the time set in your zone's SOA record, and a changed record can stay cached for its old TTL. Verify Publication asks your domain's own name servers, so it shows the live record straight away.