OneTaskBy Tim King · Updated
DMARC Record Generator
Policy, Report Addresses, Alignment and Percentage Settings With Copyable TXT Value
OneTask is free, with no sign-up, and built by one person.
If this tool saved you time, a coffee helps keep new ones coming.
How the DMARC Record Generator works
This DMARC record generator builds the TXT record that tells mail providers what to do with email that fails SPF and DKIM checks for your domain. Choose a policy and a report address, then publish the value at _dmarc on your domain to start seeing who sends mail as you.
How to use the DMARC record generator safely
DMARC ties SPF and DKIM to the From address people actually see, and gives receivers a policy for messages that fail. The record always starts with v=DMARC1 and a p tag. The policy none only collects reports, quarantine sends failing mail to spam, and reject refuses it outright.
Start with none and an aggregate report address. Providers such as Gmail and Microsoft then send daily XML reports listing every server that sent mail using your domain and whether it passed. Once every real sender passes, move to quarantine, optionally with a lower percentage so only part of the failing mail is affected, and finally to reject.
Relaxed alignment lets mail from a subdomain count for the parent domain and suits almost everyone. Strict alignment needs an exact match. Failure reports carry message details and few providers still send them, so the aggregate address matters far more. Gmail and Yahoo require at least p=none from bulk senders.
FAQ
Where do I publish the DMARC record?
Add a TXT record with the host name _dmarc and the generated value. Some DNS panels want the full name _dmarc.example.com and others just _dmarc, so check whether yours adds the domain automatically.
How long should I stay on p=none?
Usually two to four weeks, long enough to see reports from all your senders, including newsletters, invoicing and help desk tools. Fix each one that fails before moving to quarantine.
Can I send reports to an address on another domain?
Yes, but the receiving domain must publish a small authorisation record, otherwise providers will not send the reports. Hosted DMARC report services set this up for you when you sign up.
See also: all Security & Identifiers tools, Dev Utilities, Formatters & Validators, Data & Encoding, SEO, Accessibility, AI.
Related tools
SPF Record Generator
Build an SPF record from the email services you actually use.
DMARC Report Viewer
Turn a DMARC aggregate XML report into a readable table.
Email Header Analyzer
Trace an email's route and check its SPF, DKIM and DMARC results.
Email DNS Record Checker
Check an SPF, DKIM or DMARC record before you publish it.
.env File Checker
Lint a .env file for syntax errors, duplicates and weak secrets.