DMARC Record Generator

How this tool works

This generator builds a DMARC TXT record from your selected options following current DMARC syntax. It produces the record value to publish at _dmarc.{domain}. Presets (Monitor, Quarantine, Reject) set sensible defaults; advanced options let you control alignment, subdomain policy, and forensic reporting. Note: DMARCbis (RFC 9989) removed the pct tag, so records are generated without it — you roll out by advancing the whole policy in stages, not by percentage.

Note: This tool generates the record — it does not publish it. You must add the generated TXT record to your DNS provider. Always start with p=none and monitor aggregate reports before tightening enforcement.

Step 1: Start with p=none

Begin by deploying a DMARC record with p=none. This tells receivers to send you reports without affecting email delivery. Monitor for 2-4 weeks.

Step 2: Move to p=quarantine

Once you have confirmed from your aggregate reports that legitimate senders pass SPF and DKIM, set p=quarantine. Failing mail is sent to spam/junk. Hold here through a stable observation window while you finish authorizing any remaining senders.

Step 3: Full enforcement with p=reject

After a clean observation window at quarantine, set p=reject to block all unauthorized emails. This provides maximum protection against spoofing. (DMARCbis removed percentage-based ramping — you advance the whole policy in stages, not a percentage.)

Common Mistakes

• Jumping straight to p=reject without monitoring
• Forgetting to include all legitimate senders in SPF
• Not setting up DKIM for third-party services
• Using the wrong domain in rua/ruf addresses