DMARC record generator
Roll out DMARC safely: start by watching, then tighten step by step.
What you get
Enter your domain and a few choices, and the generator gives you the DMARC record to publish, the same record as a ready-made zone-file line (the plain-text format DNS servers store records in) and a four-step plan that leads from monitoring to p=reject. If your reports go to a mailbox on another domain, it also gives you the authorisation record that domain has to publish. Every value is checked first, so a mistake comes back as a message instead of a broken record.
A DMARC record is a TXT entry at _dmarc.yourdomain made of tags such as p, rua and adkim. The generator follows DMARCbis (RFC 9989), so it supports np and the testing flag t. It still writes the older pct and ri tags if you ask for them, because large providers still honour them.
The generator makes no DNS requests, so it does not look at your current record. Your choices go to our server, which builds the record. They are not part of our routine logs and are held in memory for at most a day. On the website, Google Analytics also records what you enter, as the privacy policy explains.
How to roll out DMARC step by step
- Monitor with p=nonePublish
v=DMARC1; p=none; rua=mailto:[email protected]. Receivers send reports but still deliver everything. Keep it for a few weeks, and make each real sender pass SPF or DKIM with your domain. - Quarantine a sliceThe plan then sets
p=quarantine; pct=25, so about a quarter of failing mail goes to spam.pctis a legacy tag that large providers still honour. A receiver that has dropped it quarantines all failing mail, so start this step only when you are ready for that. - Quarantine everythingRemove
pct. Every failing message now goes to spam. Keep reading the reports for legitimate mail that gets caught. - Finish at rejectWhen the reports show only unwanted mail failing, set
p=reject. Keep the report address active, because new senders appear over time.
Under DMARCbis the testing flag t=y replaces pct as the way to test a new policy. It asks receivers to treat your policy one step more gently while you test, so quarantine acts like none and reject acts like quarantine. The plan does not use it, but you can switch it on under More options. The four plan records keep your report addresses, alignment and failure options. They leave out sp, np and t, so add those yourself at the step where you want them.
Publish each record as a TXT record at _dmarc.example.com, then confirm it with the DMARC checker.
Choosing the options
| Option | What to choose | Why |
|---|---|---|
Policy p | none first, then quarantine, then reject. The form starts on none. | It gives you time to find senders you forgot. |
Subdomain policy sp | Leave it empty to follow p, or choose reject if your subdomains should not send mail. | Attackers like unused subdomains. |
Non-existent subdomain policy np | reject, even while p is still softer. | No real mail comes from names that do not exist. Receivers that only know RFC 7489 ignore it. |
Aggregate reports rua | A mailbox you will read, or the address a reporting service gives you. Up to 10 addresses. | Reports are daily XML files from many receivers. |
Failure reports ruf | Usually leave it empty. | Most large providers do not send them, and they can contain parts of messages. |
Alignment adkim / aspf | Leave both on Default, which means relaxed. The generator then leaves the tags out. | Relaxed lets mail.example.com align with example.com. Strict needs an exact match. |
Failure options fo | Only with ruf. 1 asks for a report when any check fails. | The default, 0, asks only when every check fails. |
Percentage pct, interval ri | pct only as a short rollout aid. Skip ri. | DMARCbis removed both. Large receivers send daily reports whatever ri says. |
Testing mode t | Switch it on while you test a stricter policy. | It asks receivers to be one step gentler. It does nothing with p=none. |
Mistakes to avoid
- Enforcing too early. A sender you forgot starts landing in spam or bouncing before you notice.
- Sending reports to your personal inbox. A busy domain can receive hundreds of report emails a day. Use a dedicated mailbox or a reporting service.
- Forgetting third-party senders. Newsletters, billing, support and CRM tools must sign with your domain (custom DKIM) or use your domain as their bounce address (the return path).
- Publishing two records. Receivers discard both. Edit the existing TXT record at
_dmarcinstead. - Using the wrong host name. Some DNS panels add the zone name themselves, so enter just
_dmarc, not_dmarc.example.com. Paste the value without quotes, because most panels add them. - Weakening subdomains by accident. An
spsofter thanpleaves subdomains easier to forge. Leavespout so they followp. - Skipping SPF and DKIM. DMARC needs one of them to pass with alignment. Build your SPF record and turn on DKIM at your mail provider.
How the record is built
The generator accepts a domain, a URL, an email address or the name _dmarc.example.com and reduces it to the domain. It checks the policy values, the report addresses, the alignment modes, the failure options and the legacy numbers. It adds mailto: to a bare address, drops duplicates and writes the tags in a fixed order: v, p, sp, np, pct, rua, ruf, adkim, aspf, fo, ri, t. A value longer than 255 bytes is also shown as several quoted strings, because a single DNS string cannot be longer. The same function runs behind the REST API and the MCP server.
_dmarc.example.com. 3600 IN TXT "v=DMARC1; p=none; rua=mailto:[email protected]"Standards
- RFC 9989: DMARCbis, published in May 2026. It defines the current tags, including
np,psdandt, and replaces RFC 7489. - RFC 9990 and RFC 9991: the aggregate and failure report formats.
- RFC 7489: the earlier specification, which still defines
pct,rfandri. - RFC 7208 and RFC 6376: SPF and DKIM, whose results DMARC combines.
Questions people ask
How do I create a DMARC record?
Enter your domain, keep the policy on none and add a report address. Copy the generated value into a TXT record named _dmarc in your DNS, then check it with the DMARC checker. The generator builds new records only. If you already have one, use the checker to read it, then edit the existing record instead of adding a second.
What is the safest DMARC policy to start with?
Use p=none with a rua address. It changes nothing about delivery, and the reports show you which systems send as your domain. You can fix those senders before you enforce anything. Without a rua address, p=none teaches you nothing, so always set one.
How long should I stay on p=none?
Long enough to see every legitimate sender, usually two to four weeks. Allow a full month if you have invoicing or reminder systems that only mail now and then. Move on when the reports show your real mail passing, and the only failures left are mail you do not recognise.
What email address should I use for rua?
Use one you will actually process. For a small domain a dedicated mailbox is fine. For a busy one, use a DMARC reporting service that gives you an address and turns the XML into readable charts. If the address is on another domain, that domain must authorise it, and the generator shows the record it needs.
Is the pct tag still needed?
No. DMARCbis removed it, and the testing flag t takes over its job. Large providers still honour pct, so it works for a gradual rollout today. Treat it as a stepping stone, and finish the rollout with plain quarantine and reject.
Do subdomains need their own record?
Not usually. A subdomain without a record follows the parent's, using sp if you set it. Add a record at the subdomain only when it needs a different policy. Set np=reject on the parent to block mail from subdomains that do not exist.
How long until DMARC takes effect?
Usually within an hour, once resolvers drop the answer they cached before. Receivers look the record up as they process mail and may keep it for the record's TTL, the number of seconds a resolver may cache it. The zone-file line from the generator uses 3600, which is one hour. Reports usually start to arrive within a day or two.
Use it from AI, the API or the command line
Every LookupOwl tool is also a free API and an MCP tool, with no key and no account. This one is dmarc_generate. Please be kind to the rate limits.
curl "https://lookupowl.com/api/v1/tools/dmarc-generator?q=example.com&rua=dmarc-reports%40example.com"claude mcp add --transport http lookupowl https://lookupowl.com/mcp