Pick a DMARC policy and report address step by step, get the _dmarc TXT record and roll out safely from monitor to quarantine to reject.
◈ Built in your browser · imports your current record
Your DMARC record
Host / name
_dmarc
Record Type
TXT
Record Value
Sending reports to another domain?
When the report address is on a different domain, that domain must publish an authorisation record or receivers will not send reports:
Gmail and Yahoo require senders of over 5,000 messages a day to publish at least p=none DMARC with SPF or DKIM aligned to the From domain.
YOUR NEXT STEP
Turn a website check into a monitoring routine
Create a company account to manage sites and notifications. Pro supports 5 sites and 5-minute availability monitoring, with deep diagnostics available according to your plan and permissions.
Enter your domain and import its current DMARC record, if any.
Choose a rollout stage; for a new setup start at p=none with a report address.
Add a TXT record in DNS with host _dmarc (or _dmarc.subdomain).
Watch the reports for 2–4 weeks and move to quarantine and reject once legitimate mail passes.
How DMARC protects your domain
DMARC ties the SPF and DKIM results to the domain in the visible From address: a message passes if either one passes and aligns. Otherwise receivers apply your published policy (deliver, spam or reject) and send you reports.
From p=none to p=reject
Jumping straight to reject easily blocks your own marketing, helpdesk or forwarded mail. The safe path is p=none for 2–4 weeks while you fix missing SPF/DKIM, then p=quarantine with a rising pct, and finally p=reject.
Frequently asked questions
What host name does the DMARC record use?
Use _dmarc with type TXT. The full name is _dmarc.example.com; many DNS panels append the domain for you, so do not type it twice.
Can I add DMARC without SPF or DKIM?
You can publish p=none to collect reports, but quarantine or reject would fail all your mail. Set up SPF and DKIM first.
How do I read DMARC reports?
Aggregate reports are zipped XML files listing message counts and SPF/DKIM results per sending IP. Look for unknown IPs (possible spoofing) and your own services that fail (configuration to fix).
What is the difference between p=quarantine and p=reject?
quarantine sends failing mail to the spam folder, where users can still find it; reject makes the receiving server refuse it during SMTP, so the sender gets a bounce.
CopyCopiedCopy failed. Select the text and copy it manually.Copy share linkDownloadLooking up…Next stepEnter a valid domain such as example.com.Too many lookups. Try again in a minute.Today’s free lookups are used up. Try again tomorrow.The lookup failed. Check your connection and try again.The upstream service did not respond. Try again shortly.YesNoUnknownResult served from the 10-minute cacheChecked atImported the current DMARC record.This domain has no DMARC record yet.Found {n} DMARC records; receivers ignore them all, so keep only one.p=none without a report address only ticks the “has DMARC” box; you will not see any authentication results.Before going straight to p=reject, make sure DMARC reports show every legitimate sender passing aligned SPF or DKIM, or you will block your own mail.Not a valid email address: {v}
DMARC record generator practical guide and common questions
What does a DMARC record do?
DMARC is a TXT record at the _dmarc name that tells receivers what to do when neither SPF nor DKIM proves a message comes from your domain, and where to send authentication reports.
Who is this for, and when is it useful?
Webmasters, IT and marketing teams who must meet the Gmail / Yahoo sender rules, want to stop spoofing of their domain, or plan to move DMARC from none to reject.
How do I create and add a DMARC record?
Enter your domain to import the current record, choose the rollout stage, report address and percentage, open the advanced options for alignment and failure reports if needed, and copy the _dmarc TXT record.
How do I choose between p=none, quarantine and reject?
p=none only monitors, p=quarantine sends failing mail to spam and p=reject refuses it. Start with none to collect reports and tighten once legitimate mail passes.
Where is the work performed, and which services receive data?
The record is built in your browser. Importing sends only the domain to this site’s server, which reads the _dmarc record over public DNS; nothing is stored.
