A free DMARC generator that builds a valid v=DMARC1 TXT record for your domain. Pick a DMARC policy, set alignment and reporting, copy the record. Our DMARC generator needs no signup — it is a free DMARC policy record generator that runs on the page.
Percentage of failing messages to apply the policy to. Use a low value when rolling out quarantine or reject.
A DMARC record is one TXT record published at _dmarc.yourdomain that tells receivers what to do when SPF and DKIM fail to align with the visible From domain. This free DMARC record generator turns that DMARC policy decision into correct tag syntax.
Receivers read the record at delivery time, evaluate SPF and DKIM alignment, and apply the policy you published. Our DMARC generator defaults to p=none with a reporting address, because monitoring before enforcing is the only safe rollout, and a DMARC generator that defaults to reject is dangerous.
The p tag is the whole policy decision. A DMARC generator should offer all three and default to the safe one; this free DMARC policy record generator does.
The aspf and adkim tags control how strictly the authenticated domain must match the From domain. Relaxed matches the organisational domain and is what our DMARC generator uses by default; strict requires an exact match and quietly breaks subdomain sending. Change it in this DMARC generator only when you know every aligned source.
The rua tag collects daily aggregate XML from every major receiver. Without it, a p=none record tells you nothing at all, which is why a DMARC generator treats rua as the important field rather than an optional one.
The ruf tag requests per-message forensic copies. Many receivers no longer send them for privacy reasons, so our DMARC generator sets rua always and leaves ruf optional. Aggregate data is what finds the sending source nobody remembered.
DMARC has no cryptography and no IP list of its own. It reads SPF and DKIM results and checks alignment, so DMARC generator output with neither record behind it enforces nothing. Publish SPF and DKIM first, then run this DMARC generator.
Once the DMARC record generator output is live, verify it with the email verification to remove invalid addresses before every send, or check large lists with bulk email verification. See pricing for verification plans.
What the record does
A DMARC record is one TXT record at _dmarc.yourdomain that tells receivers what to do when SPF and DKIM do not line up with the visible From domain. A free DMARC generator turns that policy into correct tag syntax.
SPF authorises the envelope sender and DKIM signs the message, but neither is tied to the address a recipient actually sees. DMARC adds alignment: the authenticated domain has to match the From domain.
That is why a domain with SPF and DKIM but no DMARC record is still trivially spoofable in the one place users look, and why a DMARC record generator is worth ninety seconds of your time.
p=none monitors and changes nothing. p=quarantine sends failing DMARC mail to spam. p=reject tells receivers to refuse it outright. Our DMARC record generator writes whichever you pick into the p tag.
This DMARC record generator defaults to p=none for a reason: publish it, read reports for a few weeks, then tighten. Starting at reject on a domain with unknown senders loses real mail on day one.
aspf and adkim each take r (relaxed, organisational domain must match) or s (strict, exact domain). Relaxed is the sane default and the one free DMARC record generator uses unless you change it.
Strict alignment breaks subdomain sending that relaxed would have allowed, which is a slow, confusing failure to debug — so the free DMARC record generator leaves both tags relaxed unless you say otherwise.
Without a reporting address, p=none tells you nothing at all. The rua tag collects daily aggregate XML from every major receiver, and that data is the only way to find the senders you forgot.
A free DMARC record generator that skips rua produces a record that is technically valid and operationally pointless, so this one asks for the reporting address first.
Tag by tag
The record is short. Knowing what each tag does is what lets you tighten it later without guessing.
The version tag must come first, and p must come second. Receivers that cannot parse the opening of the record ignore the whole thing.
One record per domain, published at _dmarc.yourdomain — not at the root. The DMARC record generator prints the exact host for you.
pct=25 applies the policy to a quarter of failing messages. It is the safe way to move from quarantine to reject without betting the whole domain on one change.
Raise it in steps, watching aggregate reports at each stage, and re-run the DMARC record generator rather than hand-editing the live TXT value.
Without sp, subdomains inherit p. With it, you can keep the parent at reject while a subdomain used by a marketing tool stays at none.
The free DMARC record generator emits sp only when you set it, because inheriting the parent policy is usually what you want.
rua receives aggregate XML daily. ruf receives per-message forensic copies, which many receivers no longer send at all for privacy reasons.
Set rua always. Treat ruf as optional and expect sparse data; free DMARC record generator marks it clearly as the optional field.
Rollout
The record is easy to publish and easy to publish badly. The sequence matters more than the syntax.
Generate the record with the free DMARC record generator, publish it at _dmarc.yourdomain as a TXT record, and wait. Nothing changes for your mail — that is the point of starting at p=none.
Reports start arriving within a day or two from the large receivers, and that is when the free DMARC record generator has actually earned its place.
Aggregate XML shows every source sending as your domain and whether each passed alignment. This is where the forgotten invoicing system turns up.
Fix SPF and DKIM for the legitimate sources you find. Do not run the DMARC record generator again to tighten the policy while any of them are still failing alignment.
Regenerate with p=quarantine, optionally with pct= to ramp. Watch for a couple of weeks, then use free DMARC record generator once more for p=reject.
Verify what actually resolves at each step with DMARC Checker, because DNS panels mangle long TXT values and a policy you think is live may not be.
New marketing platform, new helpdesk, new billing system. Each one needs SPF and DKIM alignment before it can survive an enforcing policy.
Use the free DMARC policy record generator again rather than editing the live string by hand in a DNS panel — hand edits are where stray semicolons come from.
Limits
DMARC coordinates two other records. It does not replace them and it does not touch delivery quality.
DMARC has no cryptography and no IP list. It reads SPF and DKIM results and checks alignment. With neither configured, a DMARC record accomplishes nothing.
Publish SPF and DKIM first; DMARC record generator output is the third step, not the first, and a free DMARC policy record generator cannot invent authentication you never configured.
DMARC protects your exact domain. An attacker registering a domain one character away is unaffected by any policy you publish.
That threat needs monitoring and user training, not a DNS record.
A perfect enforcement policy says nothing about whether the addresses you send to exist. Sender authentication and recipient verification are separate problems.
For the recipient side, use Email Verifier before a campaign; authentication and list hygiene are two halves of the same sending workflow.
Passing DMARC is a precondition modern receivers expect, not a delivery boost. Content, complaints, and bounce rate still decide placement.
Get the record right with the free DMARC record generator, then work on content, complaints, and bounce rate.
Reference
DMARC is defined by the IETF, and the tools around this DMARC generator cover what a DMARC generator does not.
The IETF's RFC 7489 defines DMARC, its tags, alignment, and the reporting format this DMARC record generator emits.
Every tag the DMARC record generator produces maps to a section of that document, including the reporting format.
After publishing, the DMARC Checker resolves the live record and reports the effective policy, alignment mode, and reporting addresses.
Generate with the DMARC record generator here, verify there — that pairing catches what a generator alone cannot see.
DMARC reads SPF and DKIM results. The SPF Record Generator and the DKIM tools build the two records a DMARC policy depends on.
A DMARC record generator output with no SPF and no DKIM behind it enforces nothing.
Nineteen free tools alongside the paid AI features, none of them requiring an account.
Free Tools
Free DMARC record checker: resolve the live DMARC record for any domain, parse every tag, and report the effective policy. DMARC record checker and validator, no signup.
Domain or infrastructure evidence — not mailbox proof.
Free Tools
Free SPF record checker: resolve the live SPF record for any domain, count DNS lookups, and validate the syntax. SPF record checker and validator, no signup.
Free Tools
Free DKIM record checker: resolve the live DKIM record at any selector, validate the public key, and flag truncation or testing mode. A DKIM record checker and validator.
Free Tools
Free DNS record lookup for any domain: A, AAAA, MX, TXT, NS, CNAME, SOA resolved live from authoritative nameservers. DNS record lookup tool, free, no signup.
Email Tools
Free email deliverability test: send one message and get authentication, DNS, spam-filter, blacklist, header, and content scores. A free email inbox placement test, no signup.
Sender or message diagnostics — not address discovery.
Email Verify Tools
Check if an email address is valid with a free email verifier, no signup — syntax, MX, SMTP mailbox, disposable, role and catch-all checks.
Recipient evidence — not sender or DNS configuration.
Yes — a free DMARC generator with no signup and no account. Build as many records as you need. The DMARC generator runs entirely on the page and nothing about your domain is stored.
At _dmarc.yourdomain as a TXT record — not at the domain root. Host is _dmarc, type TXT, value is the string our DMARC generator produced. One record per domain; two is a parse failure, not a merge.
p=none with a rua address. It changes nothing about your mail and starts the aggregate reports that show every sender using your domain. Move to quarantine and then reject once those reports are clean. A DMARC generator that defaults to reject costs you real mail on day one.
Alignment means the domain SPF or DKIM authenticated has to match the visible From domain. Relaxed alignment accepts the organisational domain; strict requires an exact match. The DMARC generator uses relaxed unless you change it, because strict breaks subdomain sending.
No. DMARC reads their results and enforces alignment. A record with no SPF and no DKIM behind it accomplishes nothing, which is why the DMARC generator is the third step rather than the first.
Usually two to six weeks at p=none, long enough for aggregate reports to surface every legitimate sender. Fix their SPF and DKIM alignment, then re-run a DMARC generator with p=quarantine, then p=reject.
A free DMARC policy record generator, no signup. Publish at p=none, read the reports, then use this DMARC generator again to tighten.
Free DMARC generator, no signup · Free DMARC record generator · DMARC generator: policy, alignment, reporting tags · No credit card, no signup
