DMARC Record Generator

What the generator builds

Pick a policy and reporting options and the generator writes a DMARC TXT record that follows RFC 7489. It gives you the host name (_dmarc), the exact value to paste, and a zone-file line, then explains what each choice does. Tags left at their defaults (pct=100, relaxed alignment, fo=0) are omitted, which keeps the record short.

Choosing the settings

• Policy (p): start with none so nothing is blocked while you collect reports. Move to quarantine, then reject, once every legitimate sender passes.
• Subdomain policy (sp): leave it as "same as p" unless a subdomain needs a different policy. A stricter sp is useful when subdomains never send mail.
• Percentage (pct): apply the policy to part of the failing mail while you roll it out, for example pct=25 with quarantine. BIMI requires 100.
• rua: one or more addresses for daily aggregate reports. This is the tag you need most.
• ruf and fo: per-message failure reports. Few receivers send them, and they can contain personal data. fo is only written when ruf is set.
• Alignment: relaxed lets mail.example.com align with example.com. Strict requires an exact match, which breaks many third-party senders.

Publishing it

Create a TXT record whose host is _dmarc (your DNS panel adds the domain) and paste the value without extra quotes. Delete any existing DMARC record first, because two records cancel each other. If reports go to another company's domain, that company must publish the authorization record shown in the notes. Most DMARC services already do. After publishing, confirm the record with the DMARC Record Checker.