Free IT Toolbox

DMARC record generator.

DMARC tells Gmail, Outlook and the rest what to do with email that pretends to be from your business. Answer a few plain questions below and get the exact record to paste into your DNS. It runs entirely in your browser: nothing you type is sent to our server.

Your domain *

The bare domain your email comes from, without https:// or www.

What should happen to email that pretends to be from you?Just watching (p=none)Reports come in, nothing is blocked. The safe first step.Quarantine forged mail (p=quarantine)Asks receivers to send mail that fails the checks to spam instead of the inbox.Block forged mail (p=reject)Asks receivers to refuse mail that fails the checks. Not for domains whose people send to mailing lists; see step 3 below.

Where should the daily summary reports go? (rua)

One or more email addresses, separated by commas. Mail providers send a daily summary of who is sending as your domain. A dedicated inbox helps; these reports add up.

Should subdomains be covered the same way? (sp)

This applies to subdomains like billing.example.com only when the domain you entered is your main (organizational) domain, because receivers ignore sp in the record of a subdomain. If you entered a subdomain, the choice here has no effect; the record on the main domain governs the other subdomains.

Advanced: forensic reports and strict alignment

Forensic reports, one per failure (ruf, optional)

Privacy note: forensic reports can include parts of the failing message, which may contain personal information. Most businesses skip these and rely on the daily summaries.

DKIM alignment (adkim)

SPF alignment (aspf)

Relaxed lets a subdomain sign or send for the main domain, which is how most email services work. Strict requires an exact match and breaks many senders, so leave both relaxed unless you know you need strict.

Your DMARC record

Enter your domain above and your record will appear here, ready to copy. It will be named _dmarc.example.com for example.com.

A safe order

Do not jump straight to blocking.

Turning DMARC on too hard, too fast can send real invoices and booking mail to spam. This order avoids that.

Step 1: just watch

Publish p=none with a reports address, then read a week or two of daily reports to learn who really sends mail as your domain, including services you forgot about.

Step 2: quarantine

Once the reports show your real mail passing, switch to p=quarantine so forged mail lands in spam while you confirm nothing important breaks. Older guides suggest easing in with pct=25, but the current DMARC standard (RFC 9989) dropped pct because receivers applied in-between values unreliably, so do not rely on it to limit the blast radius.

Step 3: block (unless your team uses mailing lists)

Move to p=reject, which asks receivers to refuse forged mail (DMARC is a requested policy, so some receivers quarantine instead). The daily reports keep showing you who tried. Exception: if people at your domain send to internet mailing lists or discussion groups, stay at quarantine instead. Lists often rewrite messages, which breaks the checks, and the DMARC standard (RFC 9989, section 7.4) says such domains should not publish p=reject or real mail from your people can be refused.

One warning that matters: DMARC only helps once SPF or DKIM passes and lines up with your domain. If your sending services are not set up for that yet, stay at step 1 while you fix them, or get help first.

Where it goes

Paste it where your DNS lives.

It is one TXT record. Wherever you bought the domain or manage DNS, the steps below cover the common cases.

GoDaddy

In DNS Records, add a TXT record. Put _dmarc in the Name field (GoDaddy adds your domain for you) and paste the value as-is.

Cloudflare

Under DNS, add a TXT record named _dmarc and paste the value into the Content field. Cloudflare does not need the full _dmarc.yourdomain name.

Namecheap

In Advanced DNS, add a TXT record with Host set to _dmarc and paste the value. Leave the TTL on Automatic unless you have a reason to change it.

AWS Route 53

In the console the Record name box already shows your domain as a suffix, so type just _dmarc there. Enter the value wrapped in double quotes, as AWS documents for TXT record values.

Not sure what your current setup looks like? The Free Technology Checkup reads your SPF, DKIM and DMARC records from the outside and scores them in about 20 seconds, so you can see where you are starting from and check the record took effect afterwards.

See everything in the Free IT Toolbox

Related tools: SPF Record Generator.

Want a hand with the reports?

Reading DMARC reports and lining up every sender takes patience. Book a free assessment and we will walk through yours with you, in plain English.

Book a Free Assessment (985) 370-9488

Prefer email? support@getwittco.com