DMARC record generator
The record,
then the plan to enforce it.
A DMARC record generator builds the one TXT record, published at _dmarc on your domain, that tells receivers what to do with mail that fails SPF and DKIM and where to send reports about it.
Pick where you are in the rollout, give it a report address and copy the record. It also writes the next two records with dates, because the safe first record, p=none, is a starting point.
It runs in your browser and nothing you type is sent to us. DMARC builds on SPF and DKIM, so have those in place first: the SPF record generator builds the first, and the setup guide shows how all three fit together.
By the Builderify team
One or more email addresses, separated by commas. A group or a report service works better than your own inbox.
- i p=none meets the DMARC minimum in Google’s bulk sender rules, but it suggests no action to receivers. Use the plan below to move on.
Publish it as the only TXT record on _dmarc.yourbrand.com. How to publish it.
How long to stay on p=none,
before you enforce.
Nobody publishes one right answer. Google, RFC 9989 and Microsoft each describe a different pace, and the generator’s plan offers the first two.
Google: a week, then enforce
Google’s rollout page says to start at p=none for one week and read the reports daily, because a week is usually enough for them to show every mail stream. With no issues, it moves to quarantine for a small share of messages, with 10% for a small organisation and 1% for a large one as examples, then raises it. It allows reject in place of quarantine.
RFC 9989: a month per step
For a domain whose people post to mailing lists and that wants p=reject, section 7.4 says to publish p=none for at least a month, then p=quarantine for an equally long period, comparing the reports. Section 5.1.7 adds that, depending on how often you send, it can take many months of reports before you are sure.
Microsoft: one domain at a time
Microsoft Learn says to start with a domain or subdomain with low mail volume and few sending sources, take it through none, quarantine and reject, and do the parent domain last. It warns that some false positives are almost inevitable, so go slowly.
Set up DMARC to validate the From address domain for cloud senders
Our rule of thumb, not a rule from any of them: a domain with one newsletter sender can follow Google’s pace, and a domain people write from every day should take the longer one. RFC 9989 section 5.1.7 says which p value to end on depends on your needs, so p=quarantine is a legitimate place to stop.
What has to be true before you enforce
Moving from p=none is the step that can lose real mail. RFC 9989 lists the work that comes first, in this order.
-
01
Send mail that passes SPF or DKIM for your own domain.
RFC 9989 sections 5.1.1 and 5.1.2 say the mail must carry an SPF or DKIM identifier that aligns with the From domain, and recommends having both. A tool that sends with its own bounce domain passes SPF for itself, not for you, so check the DKIM side.
-
02
Set up a mailbox for the reports.
Section 5.1.3 calls reading the aggregate reports essential. Google suggests a group or dedicated mailbox, because a busy domain can receive many reports a day.
-
03
Publish p=none with a rua address, and read what arrives.
Section 5.1.4 says domain owners usually start here, and 5.1.5 explains why: in all but the most trivial setups, a server or a third-party sender gets overlooked.
-
04
Fix every legitimate mail stream that fails.
Section 5.1.6 says these shortcomings must be addressed before you publish an enforcement policy. Then, and only then, move to quarantine or reject.
Where the reports go,
and what they look like.
The rua tag is what makes p=none useful. Without it, receivers send nothing, and you are publishing a policy blind.
What arrives
Per Google’s page, reports usually come once a day, and every server that receives mail from your domain sends one. Microsoft says the data is an XML attachment, likely compressed, listing the IP addresses sending as your domain and whether they pass. A large organisation can get hundreds or thousands a day, so Google suggests a group, a dedicated mailbox or a report service rather than your own inbox. RFC 9989 recommends parsing them by machine.
An address at another domain
If the rua address is not at your own domain, receivers check that its domain agrees. RFC 9990 section 4 says the owner of the report address publishes a TXT record at yourdomain.com._report._dmarc.theirdomain.com containing v=DMARC1;, and that without it the address is ignored. The generator prints that record when it sees an outside address. Google’s reports page gives the same example.
Failure reports (ruf)
These describe single messages. Google’s page says Gmail does not support ruf and Microsoft says Microsoft 365 does not send failure reports even when the tag is there, so the biggest receivers would send you none. The generator leaves it out.
If you use a report service
Many senders let a service receive and read the XML. Microsoft’s page points to the vendors in its MISA catalog, and Google recommends a third-party service that specialises in DMARC. Whatever the service is, its setup page gives the address to put in rua and says whether it needs a record at its end.
Sources: Google, About DMARC reports, RFC 9990, Microsoft Learn.
How to add a DMARC
record to your DNS.
A DMARC record is a TXT record at _dmarc, added where your domain’s DNS is managed: usually your registrar or a service such as Cloudflare. Google’s page says there is nothing to switch on in its Admin console, and Microsoft says it has no portal for DMARC records on custom domains; both say to add the record at your domain host.
Google’s page says to set them up at least 48 hours before DMARC; without them, mail from your domain will probably have delivery issues. The SPF record generator covers the first.
Type TXT, host _dmarc, value the record from the generator. Google warns that some domain hosts add the domain name for you, so typing the whole _dmarc.yourbrand.com there can end up as _dmarc.yourbrand.com.yourbrand.com. Check what your host shows after saving.
RFC 9989 section 4.10 says that if a lookup returns more than one DMARC record for a name, they are all discarded. Change the record you have; do not add a second.
Run nslookup -type=TXT _dmarc.yourbrand.com in a Windows or macOS terminal, or dig +short TXT _dmarc.yourbrand.com on macOS and Linux. DNS answers are cached, so a change can take as long as the old record’s TTL to reach everyone.
Microsoft Learn says a DMARC record covers every subdomain that has no record of its own, nonexistent ones included, and that a subdomain can override it with its own record. That is why you can send newsletters from news.yourbrand.com and start enforcement there first, as its rollout advice suggests.
Edit the same record when the plan says so. Each stage is the same record with a stricter p, which is why the generator writes all three at once.
For a registered but unused domain, Microsoft Learn gives v=DMARC1; p=reject at _dmarc and says the report tags are arguably not needed, because no valid mail should ever come from it. RFC 7208 says an SPF record for such a domain is a well-established best practice: v=spf1 -all. Choose “Never sends email” in the generator for both records.
Broadcast and Sequences send from your own domain, and the Domains page lists the records it needs and checks them. It treats DMARC as recommended rather than required, and counts any valid record you already publish. Sending costs 0.5 credit per email, and the 250 free credits every month cover 500 emails. See pricing.
Why a DMARC record
does less than you think.
Jumping straight to p=reject
A sender you forgot, a booking tool or an invoicing app, fails DMARC and is refused. RFC 9989 section 5.1.5 says that in all but the most trivial setups something gets overlooked, which is why the reports come first.
No rua address
With no rua, receivers must not send aggregate reports, so p=none watches nothing. The generator warns when the field is empty.
Two DMARC records
RFC 9989 discards every DMARC record found at a name when there is more than one, so a second record cancels both. Edit the one you have.
Reports to an address at another domain, with nothing published there
RFC 9990 says the address is ignored unless its domain publishes the matching record. Your reports never arrive, and the record looks fine.
Relying on SPF alone before p=reject
Forwarding usually breaks SPF while DKIM signatures survive, and RFC 9989 section 7.4 says a domain publishing p=reject must not rely solely on SPF. Check your DKIM signing first.
Strict alignment by default
Google’s page says relaxed typically gives enough protection against spoofing, and strict can send mail from your own subdomains to spam or get it rejected. Use strict when you have a reason, such as subdomains run by someone else.
Google’s sender guidelines require SPF, DKIM and DMARC from anyone sending more than 5,000 messages a day to Gmail accounts, and say the DMARC policy can be set to none. Smaller senders are asked for SPF or DKIM, and Google recommends all three. The bulk sender requirements guide works out which rules apply at your volume, and why business emails go to spam covers the other causes of the junk folder.
DMARC records, before you ask.
A record that monitors without changing how mail is handled: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com, published as a TXT record at _dmarc.yourdomain.com. Google recommends starting with p=none, and RFC 9989 says domain owners usually start there with a report address in rua. Without rua, receivers send no reports, so p=none would show you nothing.
As a TXT record whose name starts with _dmarc, on the domain you send from, in the DNS of whoever hosts it. For example.com that is _dmarc.example.com. Some DNS hosts add the domain name to whatever you type, so check the name they show after you save. A domain should have only one DMARC record: RFC 9989 discards all of them when it finds more than one.
Published advice differs. Google's rollout page says one week, reading the reports daily, then a small share of mail under quarantine. RFC 9989 says a domain whose people post to mailing lists and wants p=reject should publish p=none for at least a month, then p=quarantine for an equally long period, and that it can take many months of reports before you are sure. The generator's plan dates either pace.
RFC 9989 retired pct, saying it was applied inconsistently except at 0 and 100, and added a testing flag, t=y, which asks receivers to apply the policy one step softer. Google's and Microsoft's pages still document pct. The generator lets you choose all failing mail, t=y or a pct value, and explains each choice when you pick it.
If you send more than 5,000 messages a day to Gmail accounts, Google's sender guidelines require SPF, DKIM and a DMARC record, and say the policy can be none. Smaller senders are asked for SPF or DKIM, and Google recommends all three for everyone. The bulk sender requirements guide works out which rules apply at your volume.
Microsoft's guidance for parked domains is v=DMARC1; p=reject at _dmarc, and it says report addresses are arguably not needed because no valid mail should come from the domain. RFC 7208 calls an SPF record for domains that send no mail a well-established best practice, and gives v=spf1 -all. Choose "Never sends email" in the generator for both records.
No. It runs in your browser, so the domain and addresses you type stay on your device. It does not look anything up in DNS, so it cannot tell you what you already publish: run nslookup or dig as the page shows to see the record that is live now.
Sources
- IETF RFC 9989: DMARC (May 2026)
- IETF RFC 9990: DMARC aggregate reporting (May 2026)
- Google Workspace Admin Help Set up DMARC
- Google Workspace Admin Help Recommended DMARC rollout
- Google Workspace Admin Help About DMARC reports
- Google Email sender guidelines
- Microsoft Learn Set up DMARC to validate the From address domain for cloud senders
- IETF RFC 7208: Sender Policy Framework (SPF)
Every page above was opened on 5 November 2026. Google’s DMARC and rollout pages were last updated on 26 October 2026, by their own footers. ← All free tools
More on email deliverability
All deliverability guides- How to Set Up SPF, DKIM and DMARC, Step by Step Set up SPF, DKIM and DMARC for your newsletter domain: merge SPF records, stay under 10 lookups and build a DMARC record that meets Gmail and Yahoo rules.
- Gmail & Yahoo Bulk Sender Requirements: Do They Apply? Do the Gmail and Yahoo bulk sender requirements apply to you? Enter your busiest day to see which rules you are under and what to set up, free.
- Why Are My Business Emails Going to Spam? Find the Cause Business emails going to spam? Read the SPF, DKIM and DMARC lines in one message, then pick your symptoms to see the likely causes and fixes, free.
- Email Bounce Codes: SMTP Error Codes Explained Email bounce codes decoded: hard vs soft bounces, what 550 5.7.26, 550 5.7.515, 421 4.7.28 and 550 5.1.1 mean, and when to remove an address.
Stop losing the visitors
you already paid for.
More leads from the traffic you already have, and follow-up that sends itself. Free to start. No card, no monthly fee.