DMARC Record Generator
Pick a policy and a report address, then copy a DMARC TXT record for _dmarc.yourdomain. The output follows RFC 9989, the May 2026 standard that replaced RFC 7489, so it never writes the removed pct tag.
Configure Your DMARC Record
Host name (TXT record)
_dmarc.yourdomain.comSome DNS providers add your domain automatically. If yours does, enter only _dmarc.
Value
v=DMARC1; p=nonep=none is monitoring only. It collects reports but does not stop spoofed mail. Move to quarantine and then reject once all your senders pass.
Add a rua address. Without it you get no reports and cannot see who sends mail as your domain.
Where to publish the record
- 1
Open the DNS host, not just the registrar
Records go wherever your nameservers point. That may be Cloudflare, Route 53 or your web host rather than the company you bought the domain from.
- 2
Add one TXT record named _dmarc
Most panels add your domain to the name for you, so type only _dmarc. If yours wants the full name, enter _dmarc.example.com. If a _dmarc record already exists, edit it; two records cancel each other.
- 3
Paste the value and save
Copy the value from the box above as one line. Leave TTL at the default.
- 4
Check it, then wait for reports
Run the DMARC checker on your domain. Aggregate reports start arriving at the rua address within a day or two, from each receiver that sends them.
Step-by-step screens for Cloudflare, GoDaddy and Route 53 are in the integration guides. Once reports arrive, read them in the DMARC report analyzer.
Why there is no pct field
RFC 9989 took pct out of DMARC. Its Appendix A.6 gives the reason in one line: “Operational experience showed that the ‘pct’ tag was usually not accurately applied, unless the value specified was either 0 or 100.” Values like pct=25 meant different things at different receivers.
The useful half survives as t=y, which does what pct=0 used to: ask receivers to hold back one step while you watch the reports. If your live record says pct=100, it is the old default and removing it changes nothing. Anything else is worth replacing. The RFC 9989 change list covers the other differences.
DMARC tags, one line each
From RFC 9989 section 4.7. The full syntax guide with examples is in DMARC record syntax.
| Tag | Description |
|---|---|
| v | Version. Must be the first tag and must read exactly DMARC1, or receivers ignore the whole record. |
| p | What to do with mail that fails DMARC: none (no preference), quarantine (treat as suspicious) or reject. Covers the domain and its subdomains unless sp or np says otherwise. A record without p is read as p=none. |
| sp | Policy for subdomains that exist. Without it, p applies. Ignored when the record is published on a subdomain. |
| np | Policy for subdomains that do not exist in DNS, such as a made-up billing.example.com. Without it, sp applies, then p. Defined in RFC 9989 (it came from RFC 9091). |
| rua | mailto: addresses for daily aggregate reports, separated by commas. With no rua, receivers must not send aggregate reports. |
| ruf | mailto: addresses for per-message failure reports. Optional; receivers may send them, and Gmail and Outlook.com do not. |
| fo | When to send failure reports. 0 (default): SPF and DKIM both fail to align. 1: either fails. d: a DKIM signature fails. s: SPF fails. Ignored without ruf. |
| adkim | DKIM alignment. r (relaxed, default) accepts the same organizational domain, so mail.example.com matches example.com. s (strict) needs an exact match. |
| aspf | SPF alignment, with the same r and s values as adkim. Default r. |
| t | Test mode, new in RFC 9989. t=y asks receivers to apply one level below your policy: reject is treated as quarantine, quarantine as none. No effect on a none policy. |
| psd | Marks a public suffix domain, such as a registry's TLD. Ordinary domains leave it out. |
| pct | Removed. RFC 9989 dropped it and the IANA registry lists it as historic. The generator never writes it. |
Frequently Asked Questions
A DMARC record is a TXT record published in your DNS at _dmarc.yourdomain.com. It tells receiving mail servers how to handle messages from your domain after SPF and DKIM checks, and where to send authentication reports. RFC 9989, published in May 2026, is the current standard.
Publish your DMARC record as a TXT record in your DNS at the subdomain _dmarc.yourdomain.com. For example, if your domain is example.com, the record goes at _dmarc.example.com. Use the DNS host your nameservers point to, and keep only one record at that name.
Start with p=none to monitor your email traffic without affecting delivery. Collect aggregate reports to identify all services sending on your behalf. Move to p=quarantine or p=reject once you confirm all legitimate senders pass authentication.
Relaxed alignment allows the domain in the From header to match the SPF or DKIM domain at the organizational level. Strict alignment requires an exact match. For example, relaxed alignment allows mail.example.com to align with example.com, while strict does not.
No. RFC 9989 removed pct because receivers applied values other than 0 and 100 inconsistently. A pct=100 does nothing and can go. If you used pct=0 to test a stricter policy, the replacement is t=y. Receivers that still follow RFC 7489 ignore t, so expect the full policy there.
np sets the policy for subdomains that do not exist in DNS. Attackers sometimes send from invented names like invoices.example.com. With np=reject you can block those while existing subdomains stay under sp. If np is absent, receivers use sp, and then p.
Generate and deploy your DMARC record
DMARC+ monitors your DMARC reports, identifies unauthorized senders, and guides you to full enforcement.
Request a 14-Day Trial