DMARC Record Generator

What is a DMARC record generator?

A DMARC record generator builds the DMARC policy your domain publishes in DNS. DMARC (Domain-based Message Authentication, Reporting and Conformance) tells receiving mail servers what to do when a message claiming to come from your domain fails authentication, and where to send reports about who is sending as you. It is the record that turns SPF and DKIM from “nice to have” into real protection against spoofing and phishing in your name.

This free DMARC generator writes a correct record from a few plain-English choices: the policy, where reports should go, how much failing mail the policy applies to, what happens on subdomains and how strict alignment should be. It explains every tag in the result, checks whether your domain already publishes DMARC, verifies that an outside reporting address is authorised to receive your reports, and gives you a safe step-by-step path from monitoring to full enforcement.

Key takeaways

• Start with p=none and a reporting address. It blocks nothing and shows you every service sending as your domain.
• Move to p=quarantine, then p=reject, once every legitimate sender passes.
• Publish the record as a TXT record named _dmarc. One record per domain.
• Gmail, Yahoo and Microsoft require DMARC for bulk senders; every serious sender should have it.
• DMARC needs SPF or DKIM to pass using the same domain as the From address (alignment).

How to use the DMARC generator

1. Enter your domain, for example yourcompany.com.
2. Pick a policy. Start with none if you have never had DMARC.
3. Enter the address that should receive daily reports. A dedicated mailbox such as [email protected], or the address a DMARC reporting service gives you.
4. Set the percentage of failing mail the policy applies to. Leave 100 unless you are ramping up quarantine.
5. Choose a subdomain policy and alignment. Relaxed alignment suits almost everyone.
6. Press “Generate DMARC record”, then publish it as a TXT record with host _dmarc.

The parts of a DMARC record

A first record usually looks like this: v=DMARC1; p=none; rua=mailto:[email protected]. A fully enforced one looks like this: v=DMARC1; p=reject; rua=mailto:[email protected].

none, quarantine or reject?

p=none on its own does not stop spoofing; it is a monitoring step. The goal for most domains is reject.

A safe path from none to reject

1. Weeks 1 and 2: p=none. Read the reports. List every service sending as your domain: your mailbox provider, CRM, help desk, billing, marketing platform. Make sure each passes SPF or DKIM with your domain.
2. Fix anything that fails. Add missing senders to SPF with the SPF Generator, and turn on DKIM signing with your domain in each service.
3. Weeks 3 and 4: p=quarantine; pct=25. A quarter of failing mail goes to spam. Watch reports and complaints. Raise to 50, then 100.
4. Then p=reject. Keep reports on, and recheck whenever you add a new sending tool.

Domains that never send email can go straight to v=DMARC1; p=reject, together with an SPF record of v=spf1 -all. That stops anyone using them for phishing.

Alignment: the part most people miss

DMARC passes only when SPF or DKIM passes and the domain they checked matches the domain in the visible From address. That match is called alignment.

• SPF alignment: the envelope sender (return-path) domain must match the From domain.
• DKIM alignment: the d= domain in the DKIM signature must match the From domain.

With relaxed alignment, subdomains count as a match, so mail.yourcompany.com aligns with yourcompany.com. With strict alignment, they must be identical. Relaxed is the default and the right choice for nearly everyone; strict breaks many legitimate third-party senders.

The most common cause of DMARC failure is a sending service that signs DKIM with its own domain instead of yours. The fix is to complete the “authenticate your domain” step in that service, so it signs with your domain. You can see exactly which checks passed on a real message with the Email Header Analyzer.

Reading DMARC reports

Aggregate reports arrive as zipped XML files, usually once a day from each large mailbox provider. Each one lists the IP addresses that sent mail as your domain, how many messages, and whether SPF and DKIM passed and aligned. Raw XML is hard to read, so most teams send reports to a DMARC reporting service, which turns them into dashboards. If you do, enter the address the service gives you in the generator.

When reports go to a different domain from the one they cover, the receiving domain must publish an authorisation record, or providers may not send them. Reporting services set this up for you; the generator checks it so you know before you publish.

DMARC and the big mailbox providers

Since 2024, Gmail and Yahoo require senders of more than 5,000 messages a day to their users to publish a DMARC record (at least p=none), align it with SPF or DKIM, and authenticate with both SPF and DKIM. Microsoft announced similar requirements for high-volume senders to Outlook.com in 2025. Even below those volumes, DMARC is a strong trust signal, and a domain that can be spoofed freely is a domain whose reputation anyone can damage.

Publishing the record

1. Open your DNS provider and add a TXT record.
2. Set the host or name to _dmarc. Some providers want the full name, _dmarc.yourcompany.com.
3. Paste the record as the value and save.
4. Check for an older DMARC record and remove it. Two DMARC records are treated as none.
5. Confirm with the DMARC Checker after a few minutes.

DMARC for cold email domains

Secondary domains used for outbound should have DMARC like any other. A typical setup is SPF for the mailbox provider, DKIM signing turned on, and v=DMARC1; p=none; rua=mailto:… to start, moving to quarantine once reports are clean. Mailbox providers increasingly expect it, and it protects the domain you have spent weeks warming up. Run the Domain Health Checker on each sending domain before you launch.

Worked example

Acme has SPF and DKIM for Google Workspace but no DMARC. The team generates v=DMARC1; p=none; rua=mailto:[email protected] and publishes it. After two weeks the reports show three senders: Google (passing), their help desk (passing DKIM with acme.com) and an invoicing tool that fails because it signs with its own domain. They complete the invoicing tool’s domain authentication, see it pass in the next reports, then move to p=quarantine; pct=25, raise to 100 over two weeks, and finally switch to p=reject.

Glossary

• DMARC: a DNS policy telling receivers how to handle mail that fails SPF and DKIM alignment, and where to report.
• Alignment: the SPF or DKIM domain matching the visible From domain.
• Aggregate report (rua): a daily summary of mail sent as your domain.
• Quarantine: deliver failing mail to spam.
• Reject: refuse failing mail.

How Prosyo helps

Prosyo sends outreach from your own authenticated Google, Microsoft or SMTP mailboxes and your LinkedIn account, inside safe daily limits, so a domain protected by DMARC stays trusted. It writes personal first lines from real prospect activity and drafts every reply. Start a 7-day free trial, no card required.

Related free tools

These tools are often used together with the DMARC Generator. All of them are free and run in your browser.

• DMARC Checker: Read a published DMARC policy in plain English and grade it.
• SPF Generator: Build one valid SPF record with the lookup count checked live.
• Email Header Analyzer: See SPF, DKIM and DMARC results on a real message.
• Domain Health Checker: Score your whole sending setup in one click.