DMARC record generator: create a valid DMARC record

What each option in the generator does

The generator builds the record as you choose, following RFC 9989 section 4.7 (opens in a new tab). Every option maps to one tag:

Two points worth knowing. Failure reports can contain the header fields or even the full content of a failed message, which RFC 9991 (opens in a new tab) notes may include personal data, so many organisations collect aggregate reports only. And the generator does not write pct: RFC 9989 removed it, and test mode (t=y) asks receivers to apply one level below your stated policy while reports carry on as normal.

Which DMARC policy to start with

Start at p=none. The NCSC calls this the monitoring phase and says it "does not interfere with your email traffic in any way" (opens in a new tab). Then step up to quarantine and reject as the reports show your senders are set up correctly; the NCSC says many organisations move on from none (opens in a new tab) after about 6 to 8 weeks. Our DMARC policy guide sets out the NCSC's timings for each stage, and t=y now does the trial job the NCSC's pages give to pct.

RFC 9989 section 7.4 (opens in a new tab) adds a nuance for domains your staff use for everyday email. Because mailing lists and forwarding can break authentication, it says domains whose users might post to mailing lists should not publish p=reject, and that any such domain that still wants to move to reject should first spend at least a month at p=none and an equally long period at p=quarantine. Domains at reject must also sign mail with DKIM rather than rely on SPF alone. For many organisations, quarantine on the staff domain and reject on dedicated sending and parked domains is the sensible end point. Our DMARC policy guide covers the choice in full.

Where your DMARC reports go

The rua tag is what turns a DMARC record into a source of information. Receivers that support reporting send an aggregate report, usually covering one day, to every address you list (RFC 9989 section 4.6 (opens in a new tab) says a report should go to each one). Separate several addresses with commas.

You need somewhere that can collect and read those reports. Pointing rua at an ordinary mailbox fills it with XML files, usually gzip-compressed (RFC 9990 (opens in a new tab)); a DMARC monitoring platform gives you a dedicated address, parses the reports and names the services sending as your domain. See DMARC reports for what each report contains and our DMARC report analyser guide for how to read them.

If the report address is at a different domain, that domain must agree to receive them. Under RFC 9990 section 4 (opens in a new tab), reports for example.co.uk sent to an address at reports.example.net only flow once reports.example.net publishes a TXT record at example.co.uk._report._dmarc.reports.example.net with the value v=DMARC1;. The generator warns you when this applies. Hosted DMARC services generally publish it for you: the Check Point admin guide, for example, says Check Point adds this authorisation record automatically for its hosted report mailbox.

Adding the record to your DNS

Once the generator shows your record, publish it with your DNS host (the company that runs your domain's DNS, often your domain registrar or website host):

1. Sign in to your DNS host and open the DNS records for your domain
2. Check for an existing TXT record at _dmarc. If there is one, edit it rather than adding a second record, because two DMARC records cancel each other out
3. Add a record of type TXT
4. Enter the host name. Most DNS panels add your domain for you, so enter _dmarc; a few want the full name, such as _dmarc.example.co.uk. Entering the full name in a panel that adds the domain can create _dmarc.example.co.uk.example.co.uk, which receivers do not look up
5. Paste the value the generator gave you, starting v=DMARC1;
6. Save the record, then run the DMARC checker to confirm it is published and valid
7. Watch for your first reports: the NCSC says they start arriving from major email providers within 24 hours

Long values are fine. Some DNS panels split a long TXT value into several quoted strings, and RFC 9989 tells receivers to join them back together before reading the record. Our step-by-step guide on how to set up DMARC covers SPF and DKIM as well.

Three common records from the generator

These are three common starting points, for a domain such as example.co.uk:

The NCSC says all of your domains, including parked domains (opens in a new tab), should have DMARC records whether they are used for email or not, which is why the parked domain record is worth publishing for every domain you hold but do not send from. For more examples, including subdomain and multi-address records, see the DMARC record explained.

How we help you set up DMARC

The generator gets a valid record into your DNS. We can help with everything around it.

• Pick a policy and report address for each domain: we can help you decide which domains start at p=none, which parked domains can go straight to reject, and where each domain's reports should go
• Set up reporting: we can connect your domains to a monitoring platform so reports go to a dedicated address and are easy to read
• Choose the platform: we can supply EasyDMARC, Valimail or the Check Point Email Security DMARC Management add-on, and compare them against your senders and how hands-on you want to be
• Move to enforcement: we can help you authorise each sending service and plan the steps from p=none to quarantine and reject

Platform licences can be billed monthly, with terms confirmed at quote. Contact us for free advice.