DMARC Record Generator

Build your DMARC record for RFC 9989, starting from the one you publish now, and see what receivers will do with mail that fails.

RFC 9989, 9990 and 9991 · your current record read from your browser · nothing you type is stored

Your domainDNS read from your browser

Loads the record at _dmarc of your domain into the form. Or build one below: it updates as you change anything.

Try

Built in your browser. Only DNS questions leave it, over HTTPS to Cloudflare's resolver (Google's as a second opinion).

Example

An example record for example.com

Type your domain above to start from what it publishes now, or change anything below. The record on the right updates as you go.

pPolicy for example.com

tTest mode

t=yReceivers apply one level less: reject acts as quarantine, quarantine as none. Turn it off to enforce.

ruaWhere aggregate reports go

dmarc@example.com

DMARC Report AnalyzerDaily counts of who sends as your domain. A mailbox you read, or a DMARC report service.

spSubdomains

news.example.com, mail.example.com…

npSubdomains that don't exist

Made-up names like invoices.example.com, a favourite of spoofers.

adkimAlignment

DKIM

SPF

Relaxed lets mail.example.com count for example.com; strict needs the exact name.

This domain sends no mail

Reject everything and add the records a parked domain needs.

Failure reports and more

rufWhere failure reports go

One report per failing message. They can carry message content, and Gmail and Microsoft don't send them.

foSend failure reports when

any check failsevery check failsDKIM failsSPF fails

psd= is for public suffix operators only, so it isn't offered.

What happens to mail that fails DMARC

Mail that passes is never affected. For mail that fails, receivers read your record like this:

From example.comexample.com

p=nonedecides

—

Deliveredand reported

From a subdomainnews.example.com

p=nonedecides

—

Deliveredand reported

From a name that doesn't existx7q.example.com

p=nonedecides

—

Deliveredand reported

A policy is a request: receivers make the final call. With Honor DMARC record policy on, as Microsoft recommends, Microsoft 365 refuses reject failures with 550 5.7.1 and sends quarantine failures to Junk.

Rollout

1
Monitorp=nonep=none with reports, at least a monthnowYou are here
2
Testp=quarantine; t=yquarantine with t=y: optional
3
Quarantinep=quarantineat least as long as you monitored
4
Rejectp=rejectif your users don't post to mailing lists

Before you publish

Ready to publish

One record, with nothing receivers would skip or misread.

Good

Where your reports go

Receivers send reports to another organization's address only if it publishes a permission record.

dmarc@example.com ruaInside example.com: no permission needed

Report services publish one record that covers every domain, so their addresses usually show Authorized at once.

Where do I paste this?

Pick your DNS host: the fields below are written the way its form wants them.

Zone file line

_dmarc.example.com. 3600 IN TXT "v=DMARC1; p=none; rua=mailto:dmarc@example.com"

After you publish

Full check: example.comThe link carries these settings, never a key. Asked from your browser: Cloudflare's resolver, Google's as a second opinion.

Your DMARC recordv=DMARC1; p=none; rua=mailto:dmarc@example.com

How do I create a DMARC record?

Publish one TXT record named _dmarc at your domain, starting with v=DMARC1, a policy and an address for reports: generate a DMARC record with the tool above, and it works as soon as your DNS host serves it.

Check that your mail already passes SPF or DKIM, then start at p=none with a rua address you read: receivers keep delivering as before and send you daily reports of who sends as your domain.

Read the reports for at least a month, fix every legitimate sender that fails, then move to quarantine and reject. One record at your organizational domain covers its subdomains too.

1Publish at _dmarc_dmarc.example.com · TXT
v=DMARC1; p=none; rua=mailto:dmarc@example.com
2Receivers look it upTXT query _dmarc.example.com
3They apply your policyp=none → delivered
4Reports come back dailyaggregate report (XML, daily)dmarc@example.com

One record, four steps

DMARC record generator showing a published RFC 7489 record rewritten for RFC 9989, the policy path and the report permissions — A published record loaded from DNS: pct, rf and ri removed with the reason for each, every tag coloured like its setting, and a report address at another organization flagged.

What does each DMARC tag mean?

A DMARC record is a list of tag=value pairs: v says what it is, p what to do with failing mail, rua where reports go, and every other tag only changes a default.

RFC 9989 keeps v, p, sp, adkim, aspf, rua, ruf and fo, adds np (names that don't exist), t (test mode) and psd (for public suffix operators), and removes pct, rf and ri.

Only v must come first and be exactly DMARC1; tags RFC 9989 doesn't know are ignored, so a removed tag is harmless but does nothing.

Tag	Values	Default	What it does
v	DMARC1	required	Marks the record; must be first
p	none · quarantine · reject	none	What receivers do with failing mail from the domain
sp	none · quarantine · reject	p	The same for subdomains that exist
np new	none · quarantine · reject	sp, then p	The same for names that don't exist
t new	y · n	n	Test mode: apply one level less
rua	mailto: addresses	none	Where daily aggregate reports go
ruf	mailto: addresses	none	Where per-message failure reports go
fo	0 · 1 · d · s	0	When to send failure reports
adkim	r · s	r	DKIM alignment: relaxed or strict
aspf	r · s	r	SPF alignment: relaxed or strict
psd new	y · n · u	u	For public suffix operators only
pct removed	0–100		Removed: only 0 and 100 worked reliably
rf removed	afrf		Removed: it had one value
ri removed	seconds		Removed: reports are daily anyway

The tags of RFC 9989

Which DMARC policy should I use: none, quarantine or reject?

Start at none with reports, move to quarantine once every legitimate sender passes, and to reject when you're sure: RFC 9989 asks for at least a month at none and as long again at quarantine.

none changes nothing about delivery; quarantine sends failing mail to spam; DMARC reject refuses it. A policy is a request: receivers make the final call, and the DMARC policy generator above dates each step from today.

Domains whose users post to mailing lists SHOULD NOT use reject, because lists that change messages break DMARC for them. Google suggests a faster path (one week at none, then a small share at quarantine).

1
Monitorp=none; rua=…at least a monthnowDelivered, and reported
2
Testp=quarantine; t=yoptionalOne level less
3
Quarantinep=quarantineat least as long againno sooner than Dec 4, 2026Spam folder
4
Rejectp=rejectif your users don't post to listsno sooner than Jan 4, 2027Refused

Google's faster pathnone · 1 weekquarantine · a small sharequarantine 100%reject (optional)

The rollout, with real dates from today

What changed in DMARC with RFC 9989?

RFC 9989 (May 2026) replaced RFC 7489: it removed pct, rf and ri, added np, t and psd, and finds the organizational domain by walking up DNS instead of reading the Public Suffix List.

pct=0 now reads as t=y; any other pct is dropped because receivers applied it inconsistently. The report size suffix (!10m) is ignored.

The tree walk asks _dmarc at the name and each parent, at most eight questions, so a very deep name should carry its own record. Google's and Microsoft's help pages still describe pct.

Before

v=DMARC1; p=quarantine; pct=0; rua=mailto:dmarc@example.com~~!10m~~; rf=afrf; ri=86400

After

v=DMARC1; p=quarantine; t=y; rua=mailto:dmarc@example.com

pct=0 became t=y
rf removed
ri removed
!10m removed

The DNS tree walk_dmarc.mail.news.example.comNXDOMAIN_dmarc.news.example.comNXDOMAIN_dmarc.example.comv=DMARC1 ✓first record found wins; at most 8 questions

A published RFC 7489 record, rewritten

How do I send DMARC reports to another service?

Put the service's address in rua; when its domain isn't yours, it must publish a permission record named like example.com._report._dmarc.reports.example.net (your domain, then theirs), which report services do once for every domain with a wildcard.

Without that record receivers send the reports nowhere, and nothing tells you. The generator checks each outside address live and shows the record its owner must publish.

Use a mailbox or service built for volume: big senders get hundreds of reports a day. Failure reports (ruf) can carry message content, and Gmail and Microsoft don't send them.

Your record

v=DMARC1; p=none; rua=mailto:reports@rua.vendor.example.net

asks

permission recordexample.com._report._dmarc.rua.vendor.example.netTXT "v=DMARC1;"

sends the report

The report servicereports@rua.vendor.example.net

Report services that publish a wildcard permission

dmarcianValimailEasyDMARCPostmarkCloudflareMimecast DMARC AnalyzerProofpointAgariRed Sift OnDMARCPowerDMARCSendmarcURIportsReport URIDMARCLYFraudmarcDMARC Report

Who checks what

DMARC for Gmail, Yahoo and Outlook.com senders

Gmail, Yahoo and Outlook.com require bulk senders to publish DMARC, and p=none is enough; the From domain must also align with SPF or DKIM.

Gmail and Outlook.com count more than 5,000 messages a day; Yahoo names no threshold. Outlook.com wants SPF and DKIM both to pass, and refuses mail that fails with 550 5.7.515. A DMARC record for Google Workspace is the same as for any domain: start at p=none with a report address.

BIMI logos need more: quarantine or reject on the organizational and From domains, with no subdomain policy of none.

	Gmail	Yahoo	Outlook.com
Since	February 2024	February 2024	May 5, 2025
Who counts	over 5,000 a day	no threshold named	over 5,000 a day
DMARC	p=none is enough	p=none, and it must pass	p=none, aligned
SPF and DKIM	both	both	both must pass
Alignment	SPF or DKIM	relaxed is fine	SPF or DKIM

What each mailbox provider asks of bulk senders

DMARC for a domain that sends no mail

Publish DMARC p=reject, SPF v=spf1 -all and a null MX, with wildcard SPF and MX for subdomains, and no DKIM record at all: M3AAWG's 2022 set for parked domains.

With nothing allowed to send, reject can't hurt real mail, and receivers refuse forgeries at once. M3AAWG no longer advises an empty DKIM key here (its 2015 advice): publish no DKIM record at all.

Many parked domains? Point each _dmarc at one shared record with a CNAME, so a later change is made once.

example.net. 3600 IN TXT "v=spf1 -all"
_dmarc.example.net. 3600 IN TXT "v=DMARC1; p=reject;"
example.net. 3600 IN MX 0 .
*.example.net. 3600 IN TXT "v=spf1 -all"
*.example.net. 3600 IN MX 0 .

A forger sends as invoices@example.netRefused: SPF fails, no DKIM, DMARC says reject

The parked-domain set for example.net

Where do I add the DMARC record?

At your DNS host, as a TXT record named _dmarc: most hosts add your domain themselves, so you type only _dmarc, never _dmarc.example.com.

Typing the full name in a host that adds the domain creates _dmarc.example.com.example.com, a record nobody reads. Pick your host in the generator to see its exact fields.

One name holds one DMARC record: replace the old one rather than adding a second, or receivers ignore both.

DNS host	Name field	A long value
Cloudflare	_dmarc	one field: it splits
GoDaddy	_dmarc	one field: it splits
Namecheap	_dmarc	one field: it splits
Squarespace	_dmarc	not documented
Amazon Route 53	_dmarc	quoted strings
Google Cloud DNS	_dmarc	quoted strings
Azure DNS	_dmarc	one field: it splits
DigitalOcean	_dmarc	not documented
Hostinger	_dmarc	not documented
IONOS	_dmarc	not documented
OVHcloud	_dmarc	not documented
Porkbun	_dmarc	not documented
cPanel	_dmarc	one field: it splits
Plesk	_dmarc	not documented
Hetzner	_dmarc	quoted strings
STRATO	_dmarc	not documented
Bluehost	_dmarc	not documented

What to type, host by host

DMARC Record Generator FAQ

What is a DMARC record?

A DMARC record is a TXT record at _dmarc.yourdomain that tells receiving mail servers what to do with mail that claims to come from your domain but fails SPF and DKIM alignment, and where to send reports about it. It starts with v=DMARC1 and holds a policy: none, quarantine or reject. RFC 9989, published in May 2026, is the current standard.

What should my first DMARC record be?

Start with v=DMARC1; p=none; rua=mailto: plus an address you read. It changes nothing about delivery but makes receivers send you daily reports of every server that sends as your domain. After at least a month, once your own senders pass, move to quarantine, then reject, as RFC 9989 suggests.

Why is there no pct setting?

RFC 9989 removed pct because receivers applied values other than 0 and 100 inconsistently. Its replacement is t=y, test mode, which asks receivers to apply one level less than your policy: quarantine acts as none, reject as quarantine. Microsoft's and Google's help pages still describe pct, but RFC 9989 receivers ignore it, so the generator doesn't write it.

Can DMARC reports go to Gmail or Outlook?

Yes, any mailbox works, but a personal inbox fills up fast: large senders get hundreds of reports a day. If the address is at another organization, that domain must publish a permission record for your domain, or receivers send nothing. A mailbox at your own domain, or a DMARC report service, avoids the problem.

Do I need SPF and DKIM before DMARC?

You can publish p=none before anything else: the reports show which senders need SPF or DKIM. Before quarantine or reject, every legitimate stream must pass SPF or DKIM aligned with your From domain. RFC 9989 recommends both, and a domain at reject should DKIM-sign, because forwarding breaks SPF.

What is the difference between rua and ruf?

rua receives aggregate reports: daily XML summaries counting messages by sending server and result, with no message content. ruf receives failure reports about single messages, which can include headers or content. Many large providers, including Gmail and Microsoft, don't send failure reports, so rua is the one that matters; ruf is optional.

Should I use strict alignment?

Usually not. Relaxed alignment lets mail signed or bounced through a subdomain, like bounce.example.com, count for example.com, which is how SendGrid, Amazon SES and Mailgun send. Strict alignment needs the exact domain and fails those. Strict does stop anyone who controls a subdomain's DNS from passing as the parent, so it suits tightly run domains.

What do sp and np do?

sp sets the policy for subdomains that exist, like news.example.com, and np for names that don't exist at all, like a made-up invoices.example.com. Without them, subdomains follow p. Setting np=reject only affects failing mail from names you never created, which is how spoofers often try to slip past a parent's weaker policy.

How long does a DMARC record take to work?

It works as soon as your DNS host's servers answer with it, usually within minutes of saving. A receiver that asked just before may remember the old answer until its cache time runs out. Reports arrive about a day later, because receivers send them once every 24 hours. Use Check it's published in the generator to see what DNS answers now.

Is the DMARC generator free, and is my domain stored?

It's free, with no sign-up: this DMARC creator builds the record in your browser, and loading your current record asks Cloudflare's resolver (and Google's when Cloudflare is slow) over HTTPS directly from your browser, so your domain doesn't pass through our server. The generator never adds a report address of ours: every address in the record is one you typed.

Missing something?Suggest a feature or a new tool

DMARC Record Generator