Free tool
Free DMARC record generator
Choose a policy and a report address, then copy a DMARC record ready for your DNS.
Your DMARC record
- Type
- TXT
- Host / name
- _dmarc
- Value
- v=DMARC1; p=none
- Check:
No report address yet.
Without rua= you will not see who is sending as your domain, which is the main reason to start at p=none.
Reachbox keeps checking SPF, DKIM and DMARC on your sending domains and warms up every mailbox for free before campaigns start. Start a free trial →
What DMARC does
DMARC tells receiving mail servers what to do with email that claims to be from your domain but fails SPF and DKIM checks: deliver it anyway (p=none), send it to spam (p=quarantine) or block it (p=reject). It also asks them to send you reports, so you can see every service sending as your domain.
Since 2024, Google and Yahoo require a DMARC record from anyone sending in bulk. p=none is enough to meet that rule.
A safe rollout
- Start with p=none and a report address, and leave it for two to four weeks.
- Read the reports (a DMARC report service makes this easy) and fix any of your own services that fail.
- Move to p=quarantine, optionally for a share of mail first using the percentage setting.
- Move to p=reject once reports show only mail you recognise.
How to add it
Create a TXT record with the host _dmarc (your DNS host adds your domain after it) and paste the value from this tool. Keep only one DMARC record per domain.
DMARC only works when SPF or DKIM passes. Check all three at once. Check my domain →
Nothing you enter leaves this page. The record is built in your browser.
Questions
Which DMARC policy should I start with?
Start with p=none and a rua report address. It meets the Google and Yahoo requirement without risking any of your real email, and the reports show you what to fix before you move to quarantine or reject.
Does DMARC p=reject help cold email land in the inbox?
Not directly. Any valid DMARC record meets the sender rules, and placement then depends on reputation, content and engagement. A stricter policy protects your domain from spoofing, which matters most for your main brand domain.
What does relaxed or strict alignment mean?
Alignment checks that the domain in the From address matches the domain that passed SPF or DKIM. Relaxed allows subdomains to match (mail.example.com counts for example.com); strict needs an exact match. Relaxed is right for almost everyone.
Can I send DMARC reports to a different domain?
Yes, but that domain must publish a small record saying it accepts reports for yours. DMARC report services set this up for you. If you use your own second domain, add the record there yourself.