Free DMARC record generator
Choose your policy and where reports should go, and get a valid DMARC record to publish in your DNS. Every option is explained as you go.
- Free, no sign-up
- Built in your browser
- Notes on every option
TXT_dmarc.yourcompany.co.za_dmarcMany DNS panels add your domain to the host automatically. If yours does, enter only _dmarc.
What is a DMARC record?
A DMARC record is a DNS TXT record, published at _dmarc.yourdomain, that tells receiving servers what to do with email that fails authentication for your domain and where to send reports about it.
It does three jobs: it sets a policy (none, quarantine or reject), it requests reports, and it defines how closely SPF and DKIM must match your From domain.
About this tool
- The record is built in your browser. Nothing you enter is sent to MailMarq.
- Tags left at their default values are omitted, which keeps the record short and readable.
- Publishing the record is step one. Moving safely to p=reject depends on reading the reports it produces.
DMARC tags at a glance
Every tag a DMARC record can carry. Most domains need only v, p and rua.
| Tag | What it does | Status |
|---|---|---|
v | Version. Always DMARC1, and always first. | Required |
p | Policy for the domain: none, quarantine or reject. | Required |
sp | Policy for subdomains. Defaults to the value of p. | Optional |
pct | Share of failing mail the policy applies to. Defaults to 100. | Optional |
rua | Where aggregate reports are sent, as mailto: addresses. | Recommended |
ruf | Where failure reports are sent. Rarely honoured. | Optional |
fo | When failure reports are generated: 0, 1, d or s. | Optional |
adkim | DKIM alignment: r (relaxed, default) or s (strict). | Optional |
aspf | SPF alignment: r (relaxed, default) or s (strict). | Optional |
A safe path to p=reject
- Publish p=none with a rua address, and collect reports for two to four weeks.
- Identify every service sending as your domain, and fix SPF and DKIM alignment for each one.
- Move to p=quarantine once reports show your own mail passing.
- Move to p=reject, and keep watching reports as your team adds new services.
DMARC record questions
Short answers to what people ask most when publishing DMARC.
What should my first DMARC record be?
Start with v=DMARC1; p=none; rua=mailto: followed by an address that can receive reports. p=none changes nothing about delivery, so it is safe to publish on day one, and the reports show every service that sends as your domain before you enforce.
Where do I add a DMARC record?
In the DNS for your domain, wherever it is hosted: your registrar, your web host, Cloudflare, or a South African provider such as Afrihost or Xneelo. Create a TXT record with the host _dmarc and paste the generated value. It is usually visible within minutes to a few hours, depending on the record’s TTL.
What is the difference between rua and ruf?
rua receives aggregate reports: daily summaries of how much mail each server sent as your domain and whether it passed. ruf receives failure reports about individual messages. Aggregate reports are what you need. Few providers send failure reports, and those that do can include personal information.
Should I publish p=reject straight away?
Only if you are certain every service that sends as your domain passes SPF or DKIM with alignment. If not, legitimate invoices, newsletters and system email will bounce. Most organisations need a few weeks of reports at p=none first.
Can a domain have more than one DMARC record?
No. A domain may publish one DMARC record at _dmarc. With two, receivers ignore both and act as if you have none.
What does the sp tag do?
sp sets the policy for subdomains such as mail.yourcompany.co.za. Without it, subdomains follow the main policy. Setting sp=reject also protects subdomains that never send email, which attackers like to forge. More in DMARC for subdomains.
More free tools
Rather have the rollout done for you?
MailMarq publishes your record, reads every report, aligns each sender and takes your domain to p=reject in stages you approve. Fully managed from R3,290 a year.