Monitoring (start here)
v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com
Delivery doesn't change. Receivers send daily aggregate reports so you can find every service that sends as your domain.
Create your DMARC record
Fill in three fields. The record updates as you type, and every option is explained where you choose it.
TXT _dmarc · v=DMARC1; p=none
Example DMARC records
Quarantine, ramping up
v=DMARC1; p=quarantine; pct=25; rua=mailto:dmarc-reports@example.com
A quarter of failing mail goes to spam; the rest is delivered as before. Raise pct as reports stay clean.
Reject
v=DMARC1; p=reject; rua=mailto:dmarc-reports@example.com
Full enforcement: mail that fails DMARC is refused. Subdomains get the same policy because sp is left out.
Different policy for subdomains
v=DMARC1; p=quarantine; sp=reject; rua=mailto:dmarc-reports@example.com
Quarantine for the main domain while blocking lookalike subdomains such as billing.example.com that never send mail.
Reports to a third-party service
v=DMARC1; p=none; rua=mailto:example@reports.vendor.example
Because reports go to another domain, that domain must publish a TXT record at example.com._report._dmarc.reports.vendor.example with the value v=DMARC1. Reporting services usually publish it for their customers.
Strict alignment
v=DMARC1; p=reject; adkim=s; aspf=s; rua=mailto:dmarc-reports@example.com
Only an exact domain match aligns. Use it only when every sender signs and sends as example.com itself, not a subdomain.
DMARC Record FAQs
How do I create a DMARC record?
Choose a policy (start with p=none), add a reporting address, and publish the generated value as a TXT record at _dmarc.yourdomain.com. Then check your DMARC record to confirm it's live.
What DMARC policy should I start with?
Start with p=none to monitor without affecting delivery. Review your reports for 2-4 weeks, then move to p=quarantine and finally p=reject once legitimate senders all pass authentication.
What is the rua tag and do I need it?
The rua tag sets the address that receives aggregate XML reports. It's strongly recommended. Without it, you have no visibility into who is sending email as your domain. Use our DMARC analyzer to read the reports you receive.
How do I add the DMARC record to my DNS?
In your DNS provider, create a TXT record with host _dmarc, paste the generated value, and keep the default TTL. A new record is usually visible within minutes; edits to an existing record can take up to its TTL.
Can a domain have more than one DMARC record?
No. Publishing multiple DMARC records at _dmarc causes receivers to ignore DMARC entirely. Replace your existing record instead of adding a second one.
Related tools
- DMARC checkerConfirm your record is live and see what to fix first.
- SPF record generatorBuild a valid SPF record from provider presets.
- DMARC report analyzerRead the aggregate reports your rua address receives.
- Bulk DMARC lookupCheck up to 50 domains at once.
- What is DMARC?Policies, alignment and reporting explained.