×Atomic Mail

Atomic Mail

Productivity

Get
Products
↓
Features
↓
BusinessPricingBlogContact usSupport
Sign InSign Up
Download app
Sign inCreate a free account
  1. Home
  2. Free email tools
  3. DMARC record generator
Free tool · Runs in your browser · Updated for RFC 9989

Free DMARC Record Generator

Create a valid DMARC record in a minute. Pick a policy, add where reports should go, and copy the exact DNS entry to publish.

Policy for mail that fails DMARC p

Daily summaries of who sends mail as your domain. You need these before you enforce a policy.

Advanced options (subdomains, alignment, failure reports, testing)

Per-message reports. They can contain parts of real emails, and most large providers don’t send them.

Send a failure report when fo

Your DMARC record

Type
TXT
Host / Name
_dmarc

Value

v=DMARC1; p=none
Check it after publishing

    Built in your browser. Nothing you type is sent anywhere.

    How it works

    How to create a DMARC record

    Three choices are enough for a valid record. Everything under Advanced options is optional and can stay at its default.

    1. Enter your domain

      The domain people see in the From address, for example yourcompany.com. The generator works out the DNS host name for you.

    2. Pick a policy and report address

      Start with None and a mailbox for aggregate reports. You’ll tighten the policy once the reports look clean.

    3. Copy and publish

      Add the TXT record at your DNS host, wait a few minutes, then confirm it with the DMARC checker.

    Example with a sample domain.
    Publishing

    How to add a DMARC record to your DNS

    Add the record where your domain’s DNS is hosted, which isn’t always where you bought the domain. Menus differ between providers, but the three fields are always the same.

    Type
    TXT
    Host / Name
    _dmarc
    Value
    Your record from the generator above

    Add a DMARC record in Cloudflare

    Dashboard → your domain → DNS → Records

    1. Log in to Cloudflare and select your domain.
    2. Go to DNS → Records and click Add record.
    3. Set Type to TXT and Name to _dmarc.
    4. Paste the record into Content, leave TTL on Auto and click Save.

    Cloudflare usually serves new records within a few minutes.

    Choosing a policy

    Which DMARC policy should you choose?

    Don’t jump straight to reject. Move up one step at a time, and only when your reports show your own mail passing.

    1. Weeks 1–4

      p=none

      Monitor and find every sender

      Publish with a report address. Use the reports to list every service that sends as your domain: your mailbox provider, newsletter tool, CRM, billing system.

    2. When reports are clean

      p=quarantine

      Fix senders, then quarantine

      Set up SPF or DKIM for each service until it passes with alignment. Add t=y first if you want a softer start.

    3. Final step

      p=reject

      Reject and keep watching

      When nothing legitimate fails, move to reject. Keep reading reports, because new tools that send as your domain need setting up too.

    Format

    DMARC record format and examples

    Every DMARC record is a list of tag=value pairs separated by semicolons, starting with v=DMARC1. Examples use example.com.

    Starter

    Monitor and collect reports

    v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com

    The record most domains should publish first.

    Testing

    Quarantine in testing mode

    v=DMARC1; p=quarantine; t=y; rua=mailto:dmarc-reports@example.com

    Receivers treat it like p=none while you confirm nothing breaks.

    Enforced

    Reject, with a reporting service

    v=DMARC1; p=reject; np=reject; rua=mailto:dmarc-reports@example.com,mailto:example@reports.example.net

    Two report addresses. The second domain must authorize receiving them.

    Report addresses

    Sending DMARC reports to another domain

    Receivers only send reports to a different domain if that domain agrees. The generator shows the extra record whenever you need one.

    When you need it

    • Your record is on example.com but reports go to dmarc@reports.example.net.
    • Then reports.example.net publishes one TXT record:
      example.com._report._dmarc.reports.example.net  "v=DMARC1"
    • DMARC services usually do this for every customer automatically.

    When you don’t

    • Reports go to the same domain, such as dmarc-reports@example.com.
    • Reports go to a subdomain of it, such as dmarc@mail.example.com.
    • Not sure? Run the DMARC checker after publishing; it tests the authorization for you.
    Subdomains

    DMARC for subdomains: sp and np

    One record on your main domain covers all of its subdomains. Two optional tags let you treat them differently.

    p

    the main domain

    Applies to example.com, and to every subdomain unless sp says otherwise.

    sp

    existing subdomains

    For mail.example.com and similar. Avoid sp=none once p enforces, or subdomains stay open to spoofing.

    np

    subdomains that don’t exist

    New in RFC 9989. np=reject blocks mail from made-up names like billing.example.com.

    FAQ

    DMARC generator FAQ

    Is this DMARC record generator free?

    Yes. There’s no account or email signup, and the record is built in your browser. Nothing you type, including report addresses, is sent anywhere.

    Can I have DMARC without DKIM?

    Yes. DMARC passes if either SPF or DKIM passes with alignment, so SPF alone can work. DKIM is still strongly recommended, because SPF breaks when mail is forwarded and DKIM usually survives.

    How many report addresses can I add?

    The standard allows a list, and the generator accepts up to five for each report type. In practice one or two are enough: your own mailbox and, if you use one, a DMARC reporting service.

    Should I use failure reports (ruf)?

    Usually not. Failure reports can include parts of real messages, and Gmail, Microsoft and most large providers don’t send them. Aggregate reports (rua) give you what you need.

    Why isn’t there a pct option?

    The updated DMARC standard, RFC 9989, removed pct, along with ri and rf. Newer receivers ignore pct. For a gradual rollout, use testing mode (t=y) under Advanced options instead.

    How do I change my DMARC policy later?

    Edit the existing TXT record at _dmarc rather than adding a new one. Two DMARC records cancel each other out. You can load your current record into this generator from the DMARC checker’s “Fix” or “Update” buttons.

    How long does a DMARC record take to work?

    Usually minutes, sometimes a few hours, depending on your DNS host and the record’s TTL. The first aggregate reports arrive about a day after receivers see mail from your domain.

    Atomic Mail Business

    Email on your own domain, set up the right way

    When you connect your domain, Atomic Mail shows you the MX, SPF, DKIM and DMARC records to add. Mail between your team is end-to-end encrypted, with no ads and no tracking.

    Get business emailCheck a DMARC record