DMARC Record Generator

Use the DMARC record generator at the top of this page. Pick a policy (start with p=none, which doesn't change delivery), add an address for reports, and copy the TXT record it builds. Publish it at _dmarc.yourdomain.com with your DNS provider, then confirm it with the DMARC checker.

DMARC (Domain-based Message Authentication, Reporting and Conformance) is a DNS TXT record that tells receivers what to do with mail that uses your domain in the From address but fails SPF and DKIM checks, and where to send reports about it. Without one, receivers have no instructions from you, and Gmail, Yahoo and Outlook.com require one from bulk senders.

A DMARC record is a DNS TXT record published at _dmarc.yourdomain.com. A typical starting record looks like: v=DMARC1; p=none; rua=mailto:reports@yourdomain.com. The v tag declares the DMARC version, the p tag sets the policy for emails that fail authentication, and the rua tag tells receivers where to send aggregate reports.

Log in to your DNS provider (Cloudflare, GoDaddy, Route 53, Namecheap, etc.), create a new TXT record, set the host or name field to _dmarc, and paste the generated record as the value. A new record is usually visible within minutes, and you can confirm it is live with our DMARC checker.

Yes. The DMARC record generator, the DMARC, SPF, and DKIM checkers, the report analyzer, and the bulk lookup tool are all completely free, with no signup, no email capture, and no limits for normal use.

SPF (Sender Policy Framework) is a DNS record that lists which mail servers are authorized to send email on behalf of your domain. When a receiving server gets an email, it checks whether the sending server's IP address is on that list. Without SPF, receivers can't tell your servers from anyone else's.

DKIM (DomainKeys Identified Mail) adds a digital signature to your outgoing emails using a private key. The corresponding public key is published in your DNS. Receiving servers use the public key to check the signature, which shows the message wasn't changed in transit and was signed with your domain's key.

SPF verifies which servers can send as your domain. DKIM proves messages haven't been tampered with. DMARC ties them together by checking that at least one passes with proper domain alignment, and it tells receiving servers what to do when checks fail: monitor, quarantine, or reject. Set up all three: SPF breaks when mail is forwarded, DKIM covers that case, and DMARC is what tells receivers to act on failures.

The policy tells receivers what to do with mail that fails DMARC. 'none' asks them to deliver it as normal and send you reports, 'quarantine' asks them to put it in the spam folder, and 'reject' asks them to refuse it. Start at 'none', then move to 'quarantine' and 'reject' once your reports show your own mail passing.

The SPF specification limits each record to 10 DNS lookups, counting 'include', 'a', 'mx', 'ptr', 'exists' and 'redirect', including the lookups inside nested includes. Exceeding this limit causes SPF validation to fail with a 'permerror', which means receiving servers treat your email as unauthenticated. Our SPF checker counts your lookups and flags when you're over the limit.

DKIM selectors are found in the DKIM-Signature header of your sent emails. Look for the 's=' tag. Common selectors include 'google' for Google Workspace, 'selector1' and 'selector2' for Microsoft 365, and 'k1' for Mailchimp. Our DKIM checker scans the selectors used by popular providers automatically.

A new DMARC, SPF or DKIM record is usually visible within minutes of saving it at your DNS provider. If you edit an existing record, resolvers can keep serving the old value until its TTL (Time To Live) expires, often an hour. The 24-48 hour figure you may have seen applies to nameserver changes, not new records. Use our checkers to confirm your records are live.

Yes. Each domain needs its own DMARC, SPF and DKIM records, and every tool here works for any domain. To check DMARC and SPF for up to 50 domains at once, use the bulk lookup.